From 3f7f374ab32431b05449aef328b971e8837ca128 Mon Sep 17 00:00:00 2001
From: Steven Allen <steven@stebalien.com>
Date: Mon, 9 Mar 2026 08:44:55 -0700
Subject: [PATCH] nixos/calibre-server: fix service argument escaping

Fixes #493041
---
 .../modules/services/misc/calibre-server.nix  | 28 +++++++++----------
 1 file changed, 14 insertions(+), 14 deletions(-)

diff --git a/nixos/modules/services/misc/calibre-server.nix b/nixos/modules/services/misc/calibre-server.nix
index 493668b22173..d05aa14f0045 100644
--- a/nixos/modules/services/misc/calibre-server.nix
+++ b/nixos/modules/services/misc/calibre-server.nix
@@ -2,6 +2,7 @@
   config,
   lib,
   pkgs,
+  utils,
   ...
 }:
 let
@@ -11,20 +12,17 @@ let
   documentationLink = "https://manual.calibre-ebook.com";
   generatedDocumentationLink = documentationLink + "/generated/en/calibre-server.html";
 
-  execFlags = (
-    lib.concatStringsSep " " (
-      lib.mapAttrsToList (k: v: "${k} ${toString v}") (
-        lib.filterAttrs (name: value: value != null) {
-          "--listen-on" = cfg.host;
-          "--port" = cfg.port;
-          "--auth-mode" = cfg.auth.mode;
-          "--userdb" = cfg.auth.userDb;
-        }
-      )
-      ++ [ (lib.optionalString (cfg.auth.enable == true) "--enable-auth") ]
-      ++ cfg.extraFlags
+  execFlags =
+    lib.mapAttrsToList (k: v: "--${k}=${toString v}") (
+      lib.filterAttrs (name: value: value != null) {
+        listen-on = cfg.host;
+        port = cfg.port;
+        auth-mode = cfg.auth.mode;
+        userdb = cfg.auth.userDb;
+      }
     )
-  );
+    ++ lib.optional cfg.auth.enable "--enable-auth"
+    ++ cfg.extraFlags;
 in
 
 {
@@ -150,7 +148,9 @@ in
       serviceConfig = {
         User = cfg.user;
         Restart = "always";
-        ExecStart = "${cfg.package}/bin/calibre-server ${lib.concatStringsSep " " cfg.libraries} ${execFlags}";
+        ExecStart = utils.escapeSystemdExecArgs (
+          [ "${cfg.package}/bin/calibre-server" ] ++ execFlags ++ [ "--" ] ++ cfg.libraries
+        );
       };
 
     };