import os

flake.nix

@@ -57,7 +57,15 @@
       mkVm = name: mkApp "${self.nixosConfigurations.${name}.config.system.build.vm}/bin/run-nixos-vm";
     in {
       default = self.apps.${system}.worblehat;
-      worblehat = mkApp (lib.getExe self.packages.${system}.worblehat) "Run worblehat without any setup";
+      worblehat = let
+        app = pkgs.writeShellApplication {
+          name = "worblehat-with-default-config";
+          runtimeInputs = [ self.packages.${system}.worblehat ];
+          text = ''
+            worblehat -c ${./config-template.toml} "$@"
+          '';
+        };
+      in mkApp (lib.getExe app) "Run the worblehat cli with its default config against an SQLite database";
       vm = mkVm "vm" "Start a NixOS VM with worblehat installed in kiosk-mode";
       vm-non-kiosk = mkVm "vm-non-kiosk" "Start a NixOS VM with worblehat installed in nonkiosk-mode";
     });

nix/module.nix

@@ -54,10 +54,43 @@ in {
         freeformType = format.type;
       };
     };
+
+    deadline-daemon = {
+      enable = lib.mkEnableOption "" // {
+        description = ''
+          Whether to enable the worblehat deadline-daemon service,
+          which periodically checks for upcoming deadlines and notifies users.
+
+          Note that this service is independent of the main worblehat service,
+          and must be enabled separately.
+        '';
+      };
+
+      onCalendar = lib.mkOption {
+        type = lib.types.str;
+        description = ''
+          How often to trigger rendering the map,
+          in the format of a systemd timer onCalendar configuration.
+
+          See {manpage}`systemd.timer(5)`.
+        '';
+        default = "*-*-* 10:15:00";
+      };
+    };
   };
 
-  config = lib.mkIf cfg.enable (lib.mkMerge [
-    {
+  config = lib.mkMerge [
+    (lib.mkIf (cfg.enable || cfg.deadline-daemon.enable) {
+      environment.etc."worblehat/config.toml".source = format.generate "worblehat-config.toml" cfg.settings;
+
+      users = {
+        users.worblehat = {
+          group = "worblehat";
+          isNormalUser = true;
+        };
+        groups.worblehat = { };
+      };
+
       services.worblehat.settings = lib.pipe ../config-template.toml [
         builtins.readFile
         builtins.fromTOML
@@ -69,123 +102,147 @@ in {
         })
         (lib.mapAttrsRecursive (_: lib.mkDefault))
       ];
-    }
-    {
-      environment.systemPackages = [ cfg.package ];
+    })
 
-      environment.etc."worblehat/config.toml".source = format.generate "worblehat-config.toml" cfg.settings;
+    (lib.mkIf cfg.enable (lib.mkMerge [
+      {
+        environment.systemPackages = [ cfg.package ];
 
-      users = {
-        users.worblehat = {
-          group = "worblehat";
-          isNormalUser = true;
+        services.worblehat.settings.database.type = "postgresql";
+        services.worblehat.settings.database.postgresql = {
+          host = "/run/postgresql";
         };
-        groups.worblehat = { };
-      };
 
-      services.worblehat.settings.database.type = "postgresql";
-      services.worblehat.settings.database.postgresql = {
-        host = "/run/postgresql";
-      };
-
-      services.postgresql = lib.mkIf cfg.createLocalDatabase {
-        ensureDatabases = [ "worblehat" ];
-        ensureUsers = [{
-          name = "worblehat";
-          ensureDBOwnership = true;
-          ensureClauses.login = true;
-        }];
-      };
-
-      systemd.services.worblehat-setup-database = lib.mkIf cfg.createLocalDatabase {
-        description = "Dibbler database setup";
-        wantedBy = [ "default.target" ];
-        after = [ "postgresql.service" ];
-        unitConfig = {
-          ConditionPathExists = "!/var/lib/worblehat/.db-setup-done";
+        services.postgresql = lib.mkIf cfg.createLocalDatabase {
+          ensureDatabases = [ "worblehat" ];
+          ensureUsers = [{
+            name = "worblehat";
+            ensureDBOwnership = true;
+            ensureClauses.login = true;
+          }];
         };
+
+        systemd.services.worblehat-setup-database = lib.mkIf cfg.createLocalDatabase {
+          description = "Dibbler database setup";
+          wantedBy = [ "default.target" ];
+          after = [ "postgresql.service" ];
+          unitConfig = {
+            ConditionPathExists = "!/var/lib/worblehat/.db-setup-done";
+          };
+          serviceConfig = {
+            Type = "oneshot";
+            ExecStart = "${lib.getExe cfg.package} --config /etc/worblehat/config.toml create-db";
+            ExecStartPost = "${lib.getExe' pkgs.coreutils "touch"} /var/lib/worblehat/.db-setup-done";
+            StateDirectory = "worblehat";
+
+            User = "worblehat";
+            Group = "worblehat";
+          };
+        };
+      }
+      (lib.mkIf cfg.kioskMode {
+        boot.kernelParams = [
+          "console=tty1"
+        ];
+
+        users.users.worblehat = {
+          extraGroups = [ "lp" ];
+          shell = (pkgs.writeShellScriptBin "login-shell" "${lib.getExe' cfg.screenPackage "screen"} -x worblehat") // {
+            shellPath = "/bin/login-shell";
+          };
+        };
+
+        services.worblehat.settings.general = {
+          quit_allowed = false;
+          stop_allowed = false;
+        };
+
+        systemd.services.worblehat-screen-session = {
+          description = "Worblehat Screen Session";
+          wantedBy = [
+            "default.target"
+          ];
+          after = if cfg.createLocalDatabase then [
+            "postgresql.service"
+            "worblehat-setup-database.service"
+          ] else [
+            "network.target"
+          ];
+          serviceConfig = {
+            Type = "forking";
+            RemainAfterExit = false;
+            Restart = "always";
+            RestartSec = "5s";
+            SuccessExitStatus = 1;
+
+            User = "worblehat";
+            Group = "worblehat";
+
+            ExecStartPre = "-${lib.getExe' cfg.screenPackage "screen"} -X -S worblehat kill";
+            ExecStart = let
+              screenArgs = lib.escapeShellArgs [
+                # -dm creates the screen in detached mode without accessing it
+                "-dm"
+
+                # Session name
+                "-S"
+                "worblehat"
+
+                # Set optimal output mode instead of VT100 emulation
+                "-O"
+
+                # Enable login mode, updates utmp entries
+                "-l"
+              ];
+
+              worblehatArgs = lib.cli.toCommandLineShellGNU { } {
+                config = "/etc/worblehat/config.toml";
+              };
+
+            in "${lib.getExe' cfg.screenPackage "screen"} ${screenArgs} ${lib.getExe cfg.package} ${worblehatArgs} cli";
+            ExecStartPost =
+              lib.optionals (cfg.limitScreenWidth != null) [
+                "${lib.getExe' cfg.screenPackage "screen"} -X -S worblehat width ${toString cfg.limitScreenWidth}"
+              ]
+              ++ lib.optionals (cfg.limitScreenHeight != null) [
+                "${lib.getExe' cfg.screenPackage "screen"} -X -S worblehat height ${toString cfg.limitScreenHeight}"
+              ];
+          };
+        };
+
+        services.getty.autologinUser = "worblehat";
+      })
+    ]))
+
+    (lib.mkIf cfg.deadline-daemon.enable {
+      systemd.timers.worblehat-deadline-daemon = {
+        description = "Worblehat Deadline Daemon";
+        wantedBy = [ "timers.target" ];
+        timerConfig = {
+          OnCalendar = cfg.deadline-daemon.onCalendar;
+          Persistent = true;
+        };
+      };
+
+      systemd.services.worblehat-deadline-daemon = {
+        description = "Worblehat Deadline Daemon";
+        wantedBy = [ "multi-user.target" ];
+        after = [ "network.target" ];
         serviceConfig = {
           Type = "oneshot";
-          ExecStart = "${lib.getExe cfg.package} --config /etc/worblehat/config.toml create-db";
-          ExecStartPost = "${lib.getExe' pkgs.coreutils "touch"} /var/lib/worblehat/.db-setup-done";
-          StateDirectory = "worblehat";
+          CPUSchedulingPolicy = "idle";
+          IOSchedulingClass = "idle";
 
-          User = "worblehat";
-          Group = "worblehat";
-        };
-      };
-    }
-    (lib.mkIf cfg.kioskMode {
-      boot.kernelParams = [
-        "console=tty1"
-      ];
-
-      users.users.worblehat = {
-        extraGroups = [ "lp" ];
-        shell = (pkgs.writeShellScriptBin "login-shell" "${lib.getExe cfg.screenPackage} -x worblehat") // {
-          shellPath = "/bin/login-shell";
-        };
-      };
-
-      services.worblehat.settings.general = {
-        quit_allowed = false;
-        stop_allowed = false;
-      };
-
-      systemd.services.worblehat-screen-session = {
-        description = "Worblehat Screen Session";
-        wantedBy = [
-          "default.target"
-        ];
-        after = if cfg.createLocalDatabase then [
-          "postgresql.service"
-          "worblehat-setup-database.service"
-        ] else [
-          "network.target"
-        ];
-        serviceConfig = {
-          Type = "forking";
-          RemainAfterExit = false;
-          Restart = "always";
-          RestartSec = "5s";
-          SuccessExitStatus = 1;
-
-          User = "worblehat";
-          Group = "worblehat";
-
-          ExecStartPre = "-${lib.getExe cfg.screenPackage} -X -S worblehat kill";
           ExecStart = let
-            screenArgs = lib.escapeShellArgs [
-              # -dm creates the screen in detached mode without accessing it
-              "-dm"
-
-              # Session name
-              "-S"
-              "worblehat"
-
-              # Set optimal output mode instead of VT100 emulation
-              "-O"
-
-              # Enable login mode, updates utmp entries
-              "-l"
-            ];
-
             worblehatArgs = lib.cli.toCommandLineShellGNU { } {
               config = "/etc/worblehat/config.toml";
             };
+          in "${lib.getExe cfg.package} ${worblehatArgs} deadline-daemon";
 
-          in "${lib.getExe cfg.screenPackage} ${screenArgs} ${lib.getExe cfg.package} ${worblehatArgs} cli";
-          ExecStartPost =
-            lib.optionals (cfg.limitScreenWidth != null) [
-              "${lib.getExe cfg.screenPackage} -X -S worblehat width ${toString cfg.limitScreenWidth}"
-            ]
-            ++ lib.optionals (cfg.limitScreenHeight != null) [
-              "${lib.getExe cfg.screenPackage} -X -S worblehat height ${toString cfg.limitScreenHeight}"
-            ];
+          User = "worblehat";
+          Group = "worblehat";
         };
       };
-
-      services.getty.autologinUser = "worblehat";
     })
-  ]);
+  ];
 }

nix/nixos-configurations/vm-non-kiosk.nix

@@ -48,6 +48,7 @@ nixpkgs.lib.nixosSystem {
       services.worblehat = {
         enable = true;
         createLocalDatabase = true;
+        deadline-daemon.enable = true;
       };
     })
   ];

nix/nixos-configurations/vm.nix

@@ -29,6 +29,7 @@ nixpkgs.lib.nixosSystem {
             DEBUG = true;
           };
         };
+        deadline-daemon.enable = true;
       };
     })
   ];

pyproject.toml

@@ -7,10 +7,10 @@ license = { file = "LICENSE" }
 readme = "README.md"
 requires-python = ">=3.12"
 dependencies = [
-  "alembic>=1.17",
+  "alembic>=1.16",
   "beautifulsoup4>=4.14",
-  "click>=8.3",
-  "flask-admin>=2.0",
+  "click>=8.2",
+  "flask-admin>=1.6",
   "flask-sqlalchemy>=3.1",
   "flask>=3.0",
   "isbnlib>=3.10",

src/worblehat/services/config.py

@@ -2,7 +2,7 @@ import tomllib
 from pathlib import Path
 from pprint import pformat
 from typing import Any
-
+import os
 
 class Config:
     """
@@ -38,10 +38,14 @@ class Config:
 
     @staticmethod
     def read_password(password_field: str) -> str:
-        if Path(password_field).is_file():
+        file: Path = Path(password_field)
+        if file.is_file() and any([file.stat().st_mode & 0o400 and file.stat().st_uid == os.getuid(), file.stat().st_mode & 0o040 and file.stat().st_gid == os.getgid(), file.stat().st_mode & 0o004]):
             with Path(password_field).open() as f:
-                return f.read()
+                return f.read().strip()
         else:
+            raise RuntimeError(
+                f"Testing, should only use file. {password_field}",
+            )
             return password_field
 
     @classmethod