diff --git a/configs/nixos/guests/copyparty.nix b/configs/nixos/guests/copyparty.nix
index fd4d9b7..fa985b5 100644
--- a/configs/nixos/guests/copyparty.nix
+++ b/configs/nixos/guests/copyparty.nix
@@ -31,8 +31,8 @@ let
       };
 
       flags = lib.mkOption {
-        type = lib.types.listOf lib.types.str;
-        default = [ ];
+        type = lib.types.attrs;
+        default = { };
         description = "Copyparty volume flags.";
       };
     };
diff --git a/configs/nixos/hosts/pikachu/default.nix b/configs/nixos/hosts/pikachu/default.nix
index 62c0be8..7f09388 100644
--- a/configs/nixos/hosts/pikachu/default.nix
+++ b/configs/nixos/hosts/pikachu/default.nix
@@ -136,28 +136,28 @@
         hostPath = "/pikachu/__inbox";
         path = "/pikachu/__inbox";
         access.A = [ "alexion" ];
-        flags = [
-          "d2d"
-          "d2t"
-          "dthumb"
-        ];
+        flags = {
+          d2d = true;
+          d2t = true;
+          dthumb = true;
+        };
       };
       "/media" = {
         hostPath = "/pikachu/media";
         path = "/pikachu/media";
         access.A = [ "alexion" ];
-        flags = [
-          "d2d"
-          "d2t"
-          "dthumb"
-        ];
+        flags = {
+          d2d = true;
+          d2t = true;
+          dthumb = true;
+        };
       };
       "/opds" = {
         hostPath = "/pikachu/data/opds";
         path = "/pikachu/data/opds";
         access.r = [ "alexion" ];
         readOnly = true;
-        flags = [ "opds" ];
+        flags.opds = true;
       };
     };
   };
diff --git a/configs/nixos/lib/copyparty-config.nix b/configs/nixos/lib/copyparty-config.nix
deleted file mode 100644
index 4c3a52a..0000000
--- a/configs/nixos/lib/copyparty-config.nix
+++ /dev/null
@@ -1,65 +0,0 @@
-{
-  lib,
-  pkgs,
-}:
-cfg:
-let
-  renderedReverseProxy = lib.optionalString cfg.reverseProxy.enable ''
-      rproxy: 1
-      xff-hdr: x-forwarded-for
-    ${lib.concatStringsSep "\n" (map renderTrustedSource cfg.reverseProxy.trustedSources)}
-  '';
-
-  renderTrustedSource = source: "  xff-src: ${source}";
-
-  renderedVolumes = lib.concatStringsSep "\n" (lib.mapAttrsToList renderVolume cfg.volumes);
-
-  renderVolume = urlPath: volume: ''
-    [${urlPath}]
-      ${volume.path}
-      accs:
-    ${lib.concatStringsSep "\n" (lib.mapAttrsToList renderAccess volume.access)}
-    ${lib.optionalString (volume.flags != [ ]) ''
-        flags:
-      ${renderFlags volume.flags}
-    ''}
-  '';
-
-  renderAccess = permission: accounts: "    ${permission}: ${lib.concatStringsSep ", " accounts}";
-
-  renderFlags =
-    flags: lib.concatMapStringsSep "\n" (flag: "    ${flag}") (flags ++ defaultPermissionFlags flags);
-
-  defaultPermissionFlags =
-    flags:
-    lib.optionals (!(hasFlag "chmod_d" flags)) [ "chmod_d: 2770" ]
-    ++ lib.optionals (!(hasFlag "chmod_f" flags)) [ "chmod_f: 660" ];
-
-  hasFlag =
-    name: flags: lib.any (flag: lib.hasPrefix "${name}:" flag || lib.hasPrefix "${name}=" flag) flags;
-in
-pkgs.writeShellScript "copyparty-config" ''
-  set -eu
-
-  umask 077
-  password="$(${lib.getExe' pkgs.coreutils "tr"} -d '\n' < "$CREDENTIALS_DIRECTORY/password")"
-
-  cat > /run/copyparty/copyparty.conf <<EOF
-  [global]
-    p: ${toString cfg.port}
-    usernames
-    http-only
-    no-crt
-    no-thumb
-    no-snap
-    no-rescan
-    ses-db: ${cfg.stateDir}/sessions.db
-    chpw-db: ${cfg.stateDir}/chpw.json
-    shr-db: ${cfg.stateDir}/shares.db
-  ${renderedReverseProxy}
-  [accounts]
-    ${cfg.accountName}: $password
-
-  ${renderedVolumes}
-  EOF
-''
diff --git a/configs/nixos/modules/services/copyparty.nix b/configs/nixos/modules/services/copyparty/default.nix
similarity index 67%
rename from configs/nixos/modules/services/copyparty.nix
rename to configs/nixos/modules/services/copyparty/default.nix
index 174b394..d0ee978 100644
--- a/configs/nixos/modules/services/copyparty.nix
+++ b/configs/nixos/modules/services/copyparty/default.nix
@@ -6,9 +6,6 @@
 }:
 let
   cfg = config.modules.services.copyparty; # NOLINT(let_order)
-
-  configScript = (import ../../lib/copyparty-config.nix { inherit lib pkgs; }) cfg;
-
 in
 {
   options.modules.services.copyparty = {
@@ -41,7 +38,7 @@ in
     };
 
     passwordFile = lib.mkOption {
-      type = lib.types.path;
+      type = lib.types.str;
       description = "Runtime file containing the Copyparty account password.";
     };
 
@@ -76,9 +73,11 @@ in
             };
 
             flags = lib.mkOption {
-              type = lib.types.listOf lib.types.str;
-              default = [ ];
-              example = [ "dthumb" ];
+              type = lib.types.attrs;
+              default = { };
+              example = {
+                dthumb = true;
+              };
               description = "Copyparty volume flags.";
             };
           };
@@ -116,44 +115,46 @@ in
         }
       ];
 
-      users.users.${cfg.user} = {
-        isSystemUser = true;
-        uid = config.registry."stable-uid".${config.networking.hostName}.copyparty;
-        inherit (cfg) group;
-        home = cfg.stateDir;
+      services.copyparty = {
+        enable = true;
+        inherit (cfg)
+          group
+          package
+          stateDir
+          user
+          ;
+        settings = {
+          i = "0.0.0.0";
+          p = cfg.port;
+          usernames = true;
+          "http-only" = true;
+          "no-crt" = true;
+          "no-thumb" = true;
+          "no-snap" = true;
+          "no-rescan" = true;
+          "ses-db" = "${cfg.stateDir}/sessions.db";
+          "chpw-db" = "${cfg.stateDir}/chpw.json";
+          "shr-db" = "${cfg.stateDir}/shares.db";
+        }
+        // lib.optionalAttrs cfg.reverseProxy.enable {
+          rproxy = 1;
+          "xff-hdr" = "x-forwarded-for";
+        };
+        accounts.${cfg.accountName}.passwordFile = cfg.passwordFile;
+        globalExtraConfig = lib.optionalString cfg.reverseProxy.enable (
+          lib.concatMapStringsSep "\n" (source: "xff-src: ${source}") cfg.reverseProxy.trustedSources
+        );
+        volumes = lib.mapAttrs (_urlPath: volume: {
+          inherit (volume)
+            access
+            flags
+            path
+            readOnly
+            ;
+        }) cfg.volumes;
       };
 
-      systemd.services.copyparty = {
-        description = "Copyparty file server";
-        after = [ "network.target" ];
-        wantedBy = [ "multi-user.target" ];
-        serviceConfig = {
-          ReloadSignal = "SIGUSR1";
-          Type = "simple";
-          User = cfg.user;
-          Group = cfg.group;
-          WorkingDirectory = cfg.stateDir;
-          Environment = [
-            "HOME=${cfg.stateDir}"
-            "XDG_CONFIG_HOME=${cfg.stateDir}"
-          ];
-          StateDirectory = "copyparty";
-          RuntimeDirectory = "copyparty";
-          RuntimeDirectoryMode = "0700";
-          LoadCredential = [ "password:${cfg.passwordFile}" ];
-          ExecStartPre = configScript;
-          ExecStart = "${lib.getExe cfg.package} -c /run/copyparty/copyparty.conf";
-          Restart = "on-failure";
-          NoNewPrivileges = true;
-          PrivateTmp = true;
-          ProtectSystem = "strict";
-          ProtectHome = true;
-          ReadWritePaths = [
-            cfg.stateDir
-          ]
-          ++ map (volume: volume.path) (lib.filter (volume: !volume.readOnly) (lib.attrValues cfg.volumes));
-        };
-      };
+      users.users.${cfg.user}.uid = config.registry."stable-uid".${config.networking.hostName}.copyparty;
 
       networking.firewall.allowedTCPPorts = [ cfg.port ];
     })
diff --git a/configs/nixos/modules/services/copyparty/nixos-module.nix b/configs/nixos/modules/services/copyparty/nixos-module.nix
new file mode 100644
index 0000000..55d7031
--- /dev/null
+++ b/configs/nixos/modules/services/copyparty/nixos-module.nix
@@ -0,0 +1,225 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+let
+  cfg = config.services.copyparty; # NOLINT(let_order)
+
+  writableVolumes = lib.filter (volume: !volume.readOnly) (lib.attrValues cfg.volumes);
+
+  credentialName = name: "password-${builtins.substring 0 16 (builtins.hashString "sha256" name)}";
+
+  passwordPlaceholder =
+    name: "@COPYPARTY_PASSWORD_${builtins.substring 0 16 (builtins.hashString "sha256" name)}@";
+
+  renderLine =
+    indent: name: value:
+    if value == true then
+      "${indent}${name}"
+    else if value == false then
+      null
+    else if lib.isList value then
+      "${indent}${name}: ${lib.concatStringsSep ", " (map toString value)}"
+    else
+      "${indent}${name}: ${toString value}";
+
+  renderAttrs =
+    indent: attrs:
+    lib.pipe attrs [
+      lib.attrsToList
+      (map ({ name, value }: renderLine indent name value))
+      (lib.filter (line: line != null))
+      (lib.concatStringsSep "\n")
+    ];
+
+  renderSectionName = name: "[${lib.escape [ "[" "]" ] name}]";
+
+  renderSection = name: attrs: ''
+    ${renderSectionName name}
+    ${renderAttrs "" attrs}
+  '';
+
+  renderSubsection =
+    name: attrs:
+    lib.optionalString (attrs != { }) ''
+      ${name}:
+      ${renderAttrs "  " attrs}
+    '';
+
+  renderVolume = urlPath: volume: ''
+    ${renderSectionName urlPath}
+    ${volume.path}
+    ${renderSubsection "accs" volume.access}
+    ${renderSubsection "flags" (volumeFlags volume.flags)}
+  '';
+
+  volumeFlags =
+    flags:
+    lib.optionalAttrs (flags != { }) (
+      {
+        chmod_d = "2770";
+        chmod_f = "660";
+      }
+      // flags
+    );
+
+  accountPlaceholders = lib.mapAttrs (name: _account: passwordPlaceholder name) cfg.accounts;
+
+  configText = ''
+    ${renderSection "global" cfg.settings}
+    ${cfg.globalExtraConfig}
+    ${renderSection "accounts" accountPlaceholders}
+    ${lib.concatStringsSep "\n" (lib.mapAttrsToList renderVolume cfg.volumes)}
+  '';
+
+  configFile = pkgs.writeText "copyparty.conf" configText;
+
+  replaceAccountPassword = name: _account: ''
+    ${lib.getExe pkgs.replace-secret} ${lib.escapeShellArg (passwordPlaceholder name)} "$CREDENTIALS_DIRECTORY/${credentialName name}" /run/copyparty/copyparty.conf
+  '';
+in
+{
+  options.services.copyparty = {
+    enable = lib.mkEnableOption "Copyparty";
+
+    package = lib.mkPackageOption pkgs "copyparty" { };
+
+    user = lib.mkOption {
+      type = lib.types.str;
+      default = "copyparty";
+      description = "User account that runs Copyparty.";
+    };
+
+    group = lib.mkOption {
+      type = lib.types.str;
+      default = "copyparty";
+      description = "Group account that runs Copyparty.";
+    };
+
+    stateDir = lib.mkOption {
+      type = lib.types.str;
+      default = "/var/lib/copyparty";
+      description = "Directory where Copyparty stores service state.";
+    };
+
+    settings = lib.mkOption {
+      type = lib.types.attrs;
+      default = { };
+      description = "Copyparty global settings rendered in the [global] config section.";
+    };
+
+    globalExtraConfig = lib.mkOption {
+      type = lib.types.lines;
+      default = "";
+      description = "Extra Copyparty global config lines appended after rendered global settings.";
+    };
+
+    accounts = lib.mkOption {
+      type = lib.types.attrsOf (
+        lib.types.submodule {
+          options.passwordFile = lib.mkOption {
+            type = lib.types.str;
+            description = "Runtime file containing this Copyparty account's password.";
+          };
+        }
+      );
+      default = { };
+      description = "Copyparty accounts keyed by account name.";
+    };
+
+    volumes = lib.mkOption {
+      type = lib.types.attrsOf (
+        lib.types.submodule {
+          options = {
+            path = lib.mkOption {
+              type = lib.types.externalPath;
+              description = "Filesystem path served by this volume.";
+            };
+
+            access = lib.mkOption {
+              type = lib.types.attrsOf (lib.types.listOf lib.types.str);
+              default = { };
+              description = "Copyparty access map from permission string to account names.";
+            };
+
+            readOnly = lib.mkOption {
+              type = lib.types.bool;
+              default = false;
+              description = "Bind this volume read-only into the Copyparty systemd service.";
+            };
+
+            flags = lib.mkOption {
+              type = lib.types.attrs;
+              default = { };
+              description = "Copyparty volume flags.";
+            };
+          };
+        }
+      );
+      default = { };
+      description = "Copyparty volumes keyed by their URL path.";
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    assertions = [
+      {
+        assertion = cfg.accounts != { };
+        message = "services.copyparty.accounts must declare at least one account.";
+      }
+      {
+        assertion = cfg.volumes != { };
+        message = "services.copyparty.volumes must declare at least one served volume.";
+      }
+    ];
+
+    users.groups = lib.mkIf (cfg.group == "copyparty") {
+      copyparty = { };
+    };
+
+    users.users.${cfg.user} = {
+      isSystemUser = true;
+      inherit (cfg) group;
+      home = cfg.stateDir;
+    };
+
+    systemd.services.copyparty = {
+      description = "Copyparty file server";
+      after = [ "network.target" ];
+      wantedBy = [ "multi-user.target" ];
+      preStart = ''
+        ${lib.getExe' pkgs.coreutils "install"} -m 600 ${configFile} /run/copyparty/copyparty.conf
+        ${lib.concatStringsSep "\n" (lib.mapAttrsToList replaceAccountPassword cfg.accounts)}
+      '';
+      serviceConfig = {
+        ReloadSignal = "SIGUSR1";
+        Type = "simple";
+        User = cfg.user;
+        Group = cfg.group;
+        WorkingDirectory = cfg.stateDir;
+        Environment = [
+          "HOME=${cfg.stateDir}"
+          "XDG_CONFIG_HOME=${cfg.stateDir}"
+        ];
+        StateDirectory = "copyparty";
+        RuntimeDirectory = "copyparty";
+        RuntimeDirectoryMode = "0700";
+        LoadCredential = lib.mapAttrsToList (
+          name: account: "${credentialName name}:${account.passwordFile}"
+        ) cfg.accounts;
+        ExecStart = "${lib.getExe cfg.package} -c /run/copyparty/copyparty.conf";
+        Restart = "on-failure";
+        NoNewPrivileges = true;
+        PrivateTmp = true;
+        ProtectSystem = "strict";
+        ProtectHome = true;
+        ReadWritePaths = [
+          cfg.stateDir
+        ]
+        ++ map (volume: volume.path) writableVolumes;
+      };
+    };
+  };
+}