import os

flake.nix

@@ -57,7 +57,15 @@
       mkVm = name: mkApp "${self.nixosConfigurations.${name}.config.system.build.vm}/bin/run-nixos-vm";
     in {
       default = self.apps.${system}.worblehat;
-      worblehat = mkApp (lib.getExe self.packages.${system}.worblehat) "Run worblehat without any setup";
+      worblehat = let
+        app = pkgs.writeShellApplication {
+          name = "worblehat-with-default-config";
+          runtimeInputs = [ self.packages.${system}.worblehat ];
+          text = ''
+            worblehat -c ${./config-template.toml} "$@"
+          '';
+        };
+      in mkApp (lib.getExe app) "Run the worblehat cli with its default config against an SQLite database";
       vm = mkVm "vm" "Start a NixOS VM with worblehat installed in kiosk-mode";
       vm-non-kiosk = mkVm "vm-non-kiosk" "Start a NixOS VM with worblehat installed in nonkiosk-mode";
     });

nix/module.nix

@@ -54,10 +54,43 @@ in {
         freeformType = format.type;
       };
     };
+
+    deadline-daemon = {
+      enable = lib.mkEnableOption "" // {
+        description = ''
+          Whether to enable the worblehat deadline-daemon service,
+          which periodically checks for upcoming deadlines and notifies users.
+
+          Note that this service is independent of the main worblehat service,
+          and must be enabled separately.
+        '';
+      };
+
+      onCalendar = lib.mkOption {
+        type = lib.types.str;
+        description = ''
+          How often to trigger rendering the map,
+          in the format of a systemd timer onCalendar configuration.
+
+          See {manpage}`systemd.timer(5)`.
+        '';
+        default = "*-*-* 10:15:00";
+      };
+    };
+  };
+
+  config = lib.mkMerge [
+    (lib.mkIf (cfg.enable || cfg.deadline-daemon.enable) {
+      environment.etc."worblehat/config.toml".source = format.generate "worblehat-config.toml" cfg.settings;
+
+      users = {
+        users.worblehat = {
+          group = "worblehat";
+          isNormalUser = true;
+        };
+        groups.worblehat = { };
       };
 
-  config = lib.mkIf cfg.enable (lib.mkMerge [
-    {
       services.worblehat.settings = lib.pipe ../config-template.toml [
         builtins.readFile
         builtins.fromTOML
@@ -69,20 +102,12 @@ in {
         })
         (lib.mapAttrsRecursive (_: lib.mkDefault))
       ];
-    }
+    })
+
+    (lib.mkIf cfg.enable (lib.mkMerge [
       {
         environment.systemPackages = [ cfg.package ];
 
-      environment.etc."worblehat/config.toml".source = format.generate "worblehat-config.toml" cfg.settings;
-
-      users = {
-        users.worblehat = {
-          group = "worblehat";
-          isNormalUser = true;
-        };
-        groups.worblehat = { };
-      };
-
         services.worblehat.settings.database.type = "postgresql";
         services.worblehat.settings.database.postgresql = {
           host = "/run/postgresql";
@@ -122,7 +147,7 @@ in {
 
         users.users.worblehat = {
           extraGroups = [ "lp" ];
-        shell = (pkgs.writeShellScriptBin "login-shell" "${lib.getExe cfg.screenPackage} -x worblehat") // {
+          shell = (pkgs.writeShellScriptBin "login-shell" "${lib.getExe' cfg.screenPackage "screen"} -x worblehat") // {
             shellPath = "/bin/login-shell";
           };
         };
@@ -153,7 +178,7 @@ in {
             User = "worblehat";
             Group = "worblehat";
 
-          ExecStartPre = "-${lib.getExe cfg.screenPackage} -X -S worblehat kill";
+            ExecStartPre = "-${lib.getExe' cfg.screenPackage "screen"} -X -S worblehat kill";
             ExecStart = let
               screenArgs = lib.escapeShellArgs [
                 # -dm creates the screen in detached mode without accessing it
@@ -174,18 +199,50 @@ in {
                 config = "/etc/worblehat/config.toml";
               };
 
-          in "${lib.getExe cfg.screenPackage} ${screenArgs} ${lib.getExe cfg.package} ${worblehatArgs} cli";
+            in "${lib.getExe' cfg.screenPackage "screen"} ${screenArgs} ${lib.getExe cfg.package} ${worblehatArgs} cli";
             ExecStartPost =
               lib.optionals (cfg.limitScreenWidth != null) [
-              "${lib.getExe cfg.screenPackage} -X -S worblehat width ${toString cfg.limitScreenWidth}"
+                "${lib.getExe' cfg.screenPackage "screen"} -X -S worblehat width ${toString cfg.limitScreenWidth}"
               ]
               ++ lib.optionals (cfg.limitScreenHeight != null) [
-              "${lib.getExe cfg.screenPackage} -X -S worblehat height ${toString cfg.limitScreenHeight}"
+                "${lib.getExe' cfg.screenPackage "screen"} -X -S worblehat height ${toString cfg.limitScreenHeight}"
               ];
           };
         };
 
         services.getty.autologinUser = "worblehat";
       })
-  ]);
+    ]))
+
+    (lib.mkIf cfg.deadline-daemon.enable {
+      systemd.timers.worblehat-deadline-daemon = {
+        description = "Worblehat Deadline Daemon";
+        wantedBy = [ "timers.target" ];
+        timerConfig = {
+          OnCalendar = cfg.deadline-daemon.onCalendar;
+          Persistent = true;
+        };
+      };
+
+      systemd.services.worblehat-deadline-daemon = {
+        description = "Worblehat Deadline Daemon";
+        wantedBy = [ "multi-user.target" ];
+        after = [ "network.target" ];
+        serviceConfig = {
+          Type = "oneshot";
+          CPUSchedulingPolicy = "idle";
+          IOSchedulingClass = "idle";
+
+          ExecStart = let
+            worblehatArgs = lib.cli.toCommandLineShellGNU { } {
+              config = "/etc/worblehat/config.toml";
+            };
+          in "${lib.getExe cfg.package} ${worblehatArgs} deadline-daemon";
+
+          User = "worblehat";
+          Group = "worblehat";
+        };
+      };
+    })
+  ];
 }

nix/nixos-configurations/vm-non-kiosk.nix

@@ -48,6 +48,7 @@ nixpkgs.lib.nixosSystem {
       services.worblehat = {
         enable = true;
         createLocalDatabase = true;
+        deadline-daemon.enable = true;
       };
     })
   ];

nix/nixos-configurations/vm.nix

@@ -29,6 +29,7 @@ nixpkgs.lib.nixosSystem {
             DEBUG = true;
           };
         };
+        deadline-daemon.enable = true;
       };
     })
   ];

pyproject.toml

@@ -7,10 +7,10 @@ license = { file = "LICENSE" }
 readme = "README.md"
 requires-python = ">=3.12"
 dependencies = [
-  "alembic>=1.17",
+  "alembic>=1.16",
   "beautifulsoup4>=4.14",
-  "click>=8.3",
+  "click>=8.2",
-  "flask-admin>=2.0",
+  "flask-admin>=1.6",
   "flask-sqlalchemy>=3.1",
   "flask>=3.0",
   "isbnlib>=3.10",

src/worblehat/services/config.py

@@ -2,7 +2,7 @@ import tomllib
 from pathlib import Path
 from pprint import pformat
 from typing import Any
-
+import os
 
 class Config:
     """
@@ -38,10 +38,14 @@ class Config:
 
     @staticmethod
     def read_password(password_field: str) -> str:
-        if Path(password_field).is_file():
+        file: Path = Path(password_field)
+        if file.is_file() and any([file.stat().st_mode & 0o400 and file.stat().st_uid == os.getuid(), file.stat().st_mode & 0o040 and file.stat().st_gid == os.getgid(), file.stat().st_mode & 0o004]):
             with Path(password_field).open() as f:
-                return f.read()
+                return f.read().strip()
         else:
+            raise RuntimeError(
+                f"Testing, should only use file. {password_field}",
+            )
             return password_field
 
     @classmethod