bekkalokk/gitea-web: host pages

hosts/bekkalokk/services/gitea/web-secret-provider/default.nix

@@ -23,31 +23,36 @@ let
   } (builtins.fileContents ./gitea-web-secret-provider.py);
 in
 {
-  users.groups."gitea-web" = { };
-  users.users."gitea-web" = {
-    group = "gitea-web";
-    isSystemUser = true;
-  };
-
   sops.secrets."gitea/web-secret-provider/token" = {
-    owner = "gitea-web";
-    group = "gitea-web";
+    owner = "gitea";
+    group = "gitea";
     restartUnits = [
       "gitea-web-secret-provider@"
     ] ++ (map (org: "gitea-web-secret-provider@${org}") organizations);
   };
 
-  systemd.tmpfiles.settings."10-gitea-web-secret-provider" =
-    builtins.listToAttrs (map (org: {
+  systemd.tmpfiles.settings."10-gitea-web-secret-provider" = {
+    "/var/lib/gitea-web/authorized_keys.d".d = {
+      user = "gitea";
+      group = "gitea";
+      mode = "700";
+    };
+    "/var/lib/gitea-web/web".d = {
+      user = "gitea";
+      group = "nginx";
+      mode = "750";
+    };
+  } //
+  (builtins.listToAttrs (map (org: {
     name = "/var/lib/gitea-web/web/${org}";
     value = {
       d = {
-          user = "gitea-web";
+        user = "gitea";
         group = "nginx";
         mode = "750";
       };
     };
-    }) organizations);
+  }) organizations));
 
   systemd.slices.system-giteaweb = {
     description = "Gitea web directories";
@@ -71,23 +76,17 @@ in
           authorized-keys-path = "/var/lib/gitea-web/authorized_keys.d/%i";
           rrsync-script = pkgs.writeShellScript "rrsync-chown" ''
             ${lib.getExe pkgs.rrsync} -wo "$1"
-            ${pkgs.coreutils}/bin/chown -R gitea-web:nginx "$1"
+            ${pkgs.coreutils}/bin/chown -R gitea:nginx "$1"
           '';
           web-dir = "/var/lib/gitea-web/web";
         };
       in "${giteaWebSecretProviderScript} ${args}";
-
-      User = "gitea-web";
-      Group = "gitea-web";
-
-      StateDirectory = toString [
-        "gitea-web/keys/%i"
-        "gitea-web/authorized_keys.d/%i"
-      ];
+      User = "gitea";
+      Group = "gitea";
+      StateDirectory = "%i";
       LoadCredential = [
         "token:${config.sops.secrets."gitea/web-secret-provider/token".path}"
       ];
-
       NoNewPrivileges = true;
       PrivateTmp = true;
       PrivateDevices = true;