From 8462b3a5a820411eacec2945e343abd0e8f7310e Mon Sep 17 00:00:00 2001
From: alexion <contact@alexion.dev>
Date: Tue, 13 Oct 2026 20:33:25 -0400
Subject: [PATCH] refactor(copyparty): separate deployment and service policy

Move Copyparty rendering into shared dotfiles utilities, keep guest wiring focused on host/container plumbing, and let the service module derive effective volume policy.
---
 configs/nixos/guests/copyparty.nix           | 104 ++++----
 configs/nixos/hosts/pikachu/default.nix      |  16 +-
 configs/nixos/modules/services/copyparty.nix | 243 +++++++++----------
 src/dotfiles/default.nix                     |   2 +-
 src/dotfiles/{util.nix => util/default.nix}  |   3 +-
 src/dotfiles/util/format-copyparty.nix       |  58 +++++
 6 files changed, 226 insertions(+), 200 deletions(-)
 rename src/dotfiles/{util.nix => util/default.nix} (94%)
 create mode 100644 src/dotfiles/util/format-copyparty.nix

diff --git a/configs/nixos/guests/copyparty.nix b/configs/nixos/guests/copyparty.nix
index fd4d9b7..1716289 100644
--- a/configs/nixos/guests/copyparty.nix
+++ b/configs/nixos/guests/copyparty.nix
@@ -5,57 +5,13 @@
 }:
 let
   cfg = config.guests.copyparty; # NOLINT(let_order)
-
-  volumeType = lib.types.submodule {
-    options = {
-      hostPath = lib.mkOption {
-        type = lib.types.str;
-        description = "Host path bind-mounted into the Copyparty guest for this volume.";
-      };
-
-      path = lib.mkOption {
-        type = lib.types.str;
-        description = "Guest path served by this Copyparty volume.";
-      };
-
-      access = lib.mkOption {
-        type = lib.types.attrsOf (lib.types.listOf lib.types.str);
-        default = { };
-        description = "Copyparty access map from permission string to account names.";
-      };
-
-      readOnly = lib.mkOption {
-        type = lib.types.bool;
-        default = false;
-        description = "Serve this Copyparty volume read-only.";
-      };
-
-      flags = lib.mkOption {
-        type = lib.types.listOf lib.types.str;
-        default = [ ];
-        description = "Copyparty volume flags.";
-      };
-    };
-  };
 in
 {
   options.guests.copyparty = {
-    accountName = lib.mkOption {
-      type = lib.types.str;
-      default = "alexion";
-      description = "Copyparty account name configured for password authentication.";
-    };
-
     passwordSecret = lib.mkOption {
       type = lib.types.str;
-      default = "services/copyparty/users/alexion/password";
-      description = "SOPS secret name containing the Copyparty account password.";
-    };
-
-    stateDir = lib.mkOption {
-      type = lib.types.str;
-      default = "/var/lib/copyparty";
-      description = "Guest path where Copyparty stores service state.";
+      default = "services/copyparty/users/${config.user.name}/password";
+      description = "SOPS secret name that contains the Copyparty account password.";
     };
 
     statePath = lib.mkOption {
@@ -72,7 +28,39 @@ in
     };
 
     volumes = lib.mkOption {
-      type = lib.types.attrsOf volumeType;
+      type = lib.types.attrsOf (
+        lib.types.submodule {
+          options = {
+            hostPath = lib.mkOption {
+              type = lib.types.str;
+              description = "Host path bind-mounted into the Copyparty guest for this volume.";
+            };
+
+            path = lib.mkOption {
+              type = lib.types.str;
+              description = "Guest path served by this Copyparty volume.";
+            };
+
+            access = lib.mkOption {
+              type = lib.types.attrsOf (lib.types.listOf lib.types.str);
+              default = { };
+              description = "Copyparty access map from permission string to account names.";
+            };
+
+            readOnly = lib.mkOption {
+              type = lib.types.bool;
+              default = false;
+              description = "Serve this Copyparty volume read-only.";
+            };
+
+            flags = lib.mkOption {
+              type = lib.types.attrs;
+              default = { };
+              description = "Copyparty volume flags.";
+            };
+          };
+        }
+      );
       default = { };
       description = "Copyparty volumes keyed by their URL path.";
     };
@@ -102,24 +90,26 @@ in
     guests.copyparty = {
       interior.modules.services.copyparty = {
         enable = true;
-        inherit (cfg) accountName stateDir;
         passwordFile = "/run/secrets/${cfg.passwordSecret}";
         reverseProxy = {
           enable = cfg.reverseProxy.enable;
           inherit (cfg.reverseProxy) trustedSources;
         };
-        volumes = lib.mapAttrs (_urlPath: volume: {
-          inherit (volume)
-            path
-            access
-            flags
-            readOnly
-            ;
-        }) cfg.volumes;
+        volumes = lib.mapAttrs (
+          _urlPath: volume:
+          {
+            inherit (volume)
+              path
+              readOnly
+              ;
+          }
+          // lib.optionalAttrs (volume.access != { }) { inherit (volume) access; }
+          // lib.optionalAttrs (volume.flags != { }) { inherit (volume) flags; }
+        ) cfg.volumes;
       };
 
       mounts = {
-        ${cfg.stateDir} = {
+        "/var/lib/copyparty" = {
           directory = cfg.statePath;
           owner = config.registry."stable-uid".${config.networking.hostName}.copyparty;
           group = "storage";
diff --git a/configs/nixos/hosts/pikachu/default.nix b/configs/nixos/hosts/pikachu/default.nix
index 62c0be8..b7bdf4d 100644
--- a/configs/nixos/hosts/pikachu/default.nix
+++ b/configs/nixos/hosts/pikachu/default.nix
@@ -129,35 +129,21 @@
       "/" = {
         hostPath = "/pikachu/data/copyparty/root";
         path = "/srv";
-        access.r = [ "alexion" ];
         readOnly = true;
       };
       "/inbox" = {
         hostPath = "/pikachu/__inbox";
         path = "/pikachu/__inbox";
-        access.A = [ "alexion" ];
-        flags = [
-          "d2d"
-          "d2t"
-          "dthumb"
-        ];
       };
       "/media" = {
         hostPath = "/pikachu/media";
         path = "/pikachu/media";
-        access.A = [ "alexion" ];
-        flags = [
-          "d2d"
-          "d2t"
-          "dthumb"
-        ];
       };
       "/opds" = {
         hostPath = "/pikachu/data/opds";
         path = "/pikachu/data/opds";
-        access.r = [ "alexion" ];
         readOnly = true;
-        flags = [ "opds" ];
+        flags.opds = true;
       };
     };
   };
diff --git a/configs/nixos/modules/services/copyparty.nix b/configs/nixos/modules/services/copyparty.nix
index 25c1459..0461df3 100644
--- a/configs/nixos/modules/services/copyparty.nix
+++ b/configs/nixos/modules/services/copyparty.nix
@@ -2,147 +2,135 @@
   config,
   lib,
   pkgs,
+  util,
   ...
 }:
 let
   cfg = config.modules.services.copyparty; # NOLINT(let_order)
 
-  volumeType = lib.types.submodule {
-    options = {
-      path = lib.mkOption {
-        type = lib.types.str;
-        description = "Filesystem path served by this volume.";
-      };
+  accountName = config.user.name;
 
-      access = lib.mkOption {
-        type = lib.types.attrsOf (lib.types.listOf lib.types.str);
-        default = { };
-        example = {
-          A = [ "alexion" ];
-        };
-        description = "Copyparty access map from permission string to account names.";
-      };
+  serviceGroup = "storage";
 
-      readOnly = lib.mkOption {
-        type = lib.types.bool;
-        default = false;
-        description = "Serve this volume read-only.";
-      };
+  serviceStateDir = "/var/lib/copyparty";
 
-      flags = lib.mkOption {
-        type = lib.types.listOf lib.types.str;
-        default = [ ];
-        example = [ "dthumb" ];
-        description = "Copyparty volume flags.";
-      };
-    };
+  serviceUser = "copyparty";
+
+  writableVolumes = lib.filter (volume: !volume.readOnly) (lib.attrValues cfg.volumes);
+
+  port = 3923;
+  defaultAccess = {
+    A = [ accountName ];
   };
 
-  configScript = pkgs.writeShellScript "copyparty-config" ''
-    set -eu
+  defaultWritableFlags = {
+    d2d = true;
+    d2t = true;
+    dthumb = true;
+  };
 
-    umask 077
-    password="$(${pkgs.coreutils}/bin/tr -d '\n' < "$CREDENTIALS_DIRECTORY/password")"
+  credentialHash = builtins.substring 0 16 (builtins.hashString "sha256" accountName);
 
-    cat > /run/copyparty/copyparty.conf <<EOF
-    [global]
-      p: ${toString cfg.port}
-      usernames
-      http-only
-      no-crt
-      no-thumb
-      no-snap
-      no-rescan
-      ses-db: ${cfg.stateDir}/sessions.db
-      chpw-db: ${cfg.stateDir}/chpw.json
-      shr-db: ${cfg.stateDir}/shares.db
-    ${renderedReverseProxy}
-    [accounts]
-      ${cfg.accountName}: $password
+  credentialName = "password-${credentialHash}";
 
-    ${renderedVolumes}
-    EOF
-  '';
-  renderAccess = permission: accounts: "    ${permission}: ${lib.concatStringsSep ", " accounts}";
+  passwordPlaceholder = "@COPYPARTY_PASSWORD_${credentialHash}@";
 
-  hasFlag =
-    name: flags: lib.any (flag: lib.hasPrefix "${name}:" flag || lib.hasPrefix "${name}=" flag) flags;
+  globalSettings = {
+    i = "0.0.0.0";
+    usernames = true;
+    "http-only" = true;
+    "no-crt" = true;
+    "no-thumb" = true;
+    "no-snap" = true;
+    "no-rescan" = true;
+    "ses-db" = "${serviceStateDir}/sessions.db";
+    "chpw-db" = "${serviceStateDir}/chpw.json";
+    "shr-db" = "${serviceStateDir}/shares.db";
+  }
+  // lib.optionalAttrs cfg.reverseProxy.enable {
+    rproxy = 1;
+    "xff-hdr" = "x-forwarded-for";
+  };
 
-  defaultPermissionFlags =
+  globalExtraConfig = lib.optionalString cfg.reverseProxy.enable (
+    lib.concatMapStringsSep "\n" (source: "xff-src: ${source}") cfg.reverseProxy.trustedSources
+  );
+
+  volumeFlags =
     flags:
-    lib.optionals (!(hasFlag "chmod_d" flags)) [ "chmod_d: 2770" ]
-    ++ lib.optionals (!(hasFlag "chmod_f" flags)) [ "chmod_f: 660" ];
+    lib.optionalAttrs (flags != { }) (
+      {
+        chmod_d = "2770";
+        chmod_f = "660";
+      }
+      // flags
+    );
 
-  renderFlags =
-    flags: lib.concatMapStringsSep "\n" (flag: "    ${flag}") (flags ++ defaultPermissionFlags flags);
+  renderedVolumes = lib.mapAttrs (_urlPath: volume: {
+    inherit (volume) path;
+    access = if volume.readOnly then { r = [ accountName ]; } else defaultAccess // volume.access;
+    flags = volumeFlags (lib.optionalAttrs (!volume.readOnly) defaultWritableFlags // volume.flags);
+  }) cfg.volumes;
 
-  renderVolume = urlPath: volume: ''
-    [${urlPath}]
-      ${volume.path}
-      accs:
-    ${lib.concatStringsSep "\n" (lib.mapAttrsToList renderAccess volume.access)}
-    ${lib.optionalString (volume.flags != [ ]) ''
-        flags:
-      ${renderFlags volume.flags}
-    ''}
+  configText = util.formats.copyparty.render {
+    inherit globalExtraConfig;
+    accounts.${accountName} = passwordPlaceholder;
+    global = globalSettings;
+    volumes = renderedVolumes;
+  };
+
+  configFile = pkgs.writeText "copyparty.conf" configText;
+
+  replacePassword = ''
+    ${lib.getExe pkgs.replace-secret} ${lib.escapeShellArg passwordPlaceholder} "$CREDENTIALS_DIRECTORY/${credentialName}" /run/copyparty/copyparty.conf
   '';
-
-  renderTrustedSource = source: "  xff-src: ${source}";
-
-  renderedReverseProxy = lib.optionalString cfg.reverseProxy.enable ''
-      rproxy: 1
-      xff-hdr: x-forwarded-for
-    ${lib.concatStringsSep "\n" (map renderTrustedSource cfg.reverseProxy.trustedSources)}
-  '';
-
-  renderedVolumes = lib.concatStringsSep "\n" (lib.mapAttrsToList renderVolume cfg.volumes);
-
 in
 {
   options.modules.services.copyparty = {
     enable = lib.mkEnableOption "Copyparty";
 
-    package = lib.mkPackageOption pkgs "copyparty-min" { };
-
-    port = lib.mkOption {
-      type = lib.types.port;
-      default = 3923;
-      description = "Port Copyparty listens on.";
-    };
-
-    user = lib.mkOption {
-      type = lib.types.str;
-      default = "copyparty";
-      description = "User account that runs Copyparty.";
-    };
-
-    group = lib.mkOption {
-      type = lib.types.str;
-      default = "storage";
-      description = "Group account that owns Copyparty's writable state and served files.";
-    };
-
-    accountName = lib.mkOption {
-      type = lib.types.str;
-      default = "alexion";
-      description = "Copyparty account name configured for password authentication.";
-    };
-
     passwordFile = lib.mkOption {
-      type = lib.types.path;
-      description = "Runtime file containing the Copyparty account password.";
-    };
-
-    stateDir = lib.mkOption {
       type = lib.types.str;
-      default = "/var/lib/copyparty";
-      description = "Directory where Copyparty stores service state.";
+      description = "Sets the runtime file that contains the Copyparty account password.";
     };
 
     volumes = lib.mkOption {
-      type = lib.types.attrsOf volumeType;
+      type = lib.types.attrsOf (
+        lib.types.submodule {
+          options = {
+            path = lib.mkOption {
+              type = lib.types.externalPath;
+              description = "Sets the filesystem path served by this volume.";
+            };
+
+            access = lib.mkOption {
+              type = lib.types.attrsOf (lib.types.listOf lib.types.str);
+              default = { };
+              example = {
+                A = [ "alexion" ];
+              };
+              description = "Maps Copyparty permission strings to account names.";
+            };
+
+            readOnly = lib.mkOption {
+              type = lib.types.bool;
+              default = false;
+              description = "Serves this volume read-only.";
+            };
+
+            flags = lib.mkOption {
+              type = lib.types.attrs;
+              default = { };
+              example = {
+                dthumb = true;
+              };
+              description = "Sets Copyparty volume flags.";
+            };
+          };
+        }
+      );
       default = { };
-      description = "Copyparty volumes keyed by their URL path.";
+      description = "Defines Copyparty volumes by URL path.";
     };
 
     reverseProxy = {
@@ -151,7 +139,7 @@ in
       trustedSources = lib.mkOption {
         type = lib.types.listOf lib.types.str;
         default = [ ];
-        description = "IP ranges that may supply Copyparty's forwarded client IP header.";
+        description = "Lists proxy sources that can set Copyparty's forwarded client IP header.";
       };
     };
   };
@@ -173,46 +161,49 @@ in
         }
       ];
 
-      users.users.${cfg.user} = {
+      users.users.${serviceUser} = {
         isSystemUser = true;
         uid = config.registry."stable-uid".${config.networking.hostName}.copyparty;
-        inherit (cfg) group;
-        home = cfg.stateDir;
+        group = serviceGroup;
+        home = serviceStateDir;
       };
 
       systemd.services.copyparty = {
         description = "Copyparty file server";
         after = [ "network.target" ];
         wantedBy = [ "multi-user.target" ];
+        preStart = ''
+          ${lib.getExe' pkgs.coreutils "install"} -m 600 ${configFile} /run/copyparty/copyparty.conf
+          ${replacePassword}
+        '';
         serviceConfig = {
           ReloadSignal = "SIGUSR1";
           Type = "simple";
-          User = cfg.user;
-          Group = cfg.group;
-          WorkingDirectory = cfg.stateDir;
+          User = serviceUser;
+          Group = serviceGroup;
+          WorkingDirectory = serviceStateDir;
           Environment = [
-            "HOME=${cfg.stateDir}"
-            "XDG_CONFIG_HOME=${cfg.stateDir}"
+            "HOME=${serviceStateDir}"
+            "XDG_CONFIG_HOME=${serviceStateDir}"
           ];
           StateDirectory = "copyparty";
           RuntimeDirectory = "copyparty";
           RuntimeDirectoryMode = "0700";
-          LoadCredential = [ "password:${cfg.passwordFile}" ];
-          ExecStartPre = configScript;
-          ExecStart = "${lib.getExe cfg.package} -c /run/copyparty/copyparty.conf";
+          LoadCredential = [ "${credentialName}:${cfg.passwordFile}" ];
+          ExecStart = "${lib.getExe pkgs.copyparty-min} -c /run/copyparty/copyparty.conf";
           Restart = "on-failure";
           NoNewPrivileges = true;
           PrivateTmp = true;
           ProtectSystem = "strict";
           ProtectHome = true;
           ReadWritePaths = [
-            cfg.stateDir
+            serviceStateDir
           ]
-          ++ map (volume: volume.path) (lib.filter (volume: !volume.readOnly) (lib.attrValues cfg.volumes));
+          ++ map (volume: volume.path) writableVolumes;
         };
       };
 
-      networking.firewall.allowedTCPPorts = [ cfg.port ];
+      networking.firewall.allowedTCPPorts = [ port ];
     })
   ];
 }
diff --git a/src/dotfiles/default.nix b/src/dotfiles/default.nix
index 1f7d642..c7421ac 100644
--- a/src/dotfiles/default.nix
+++ b/src/dotfiles/default.nix
@@ -14,7 +14,7 @@ let
     registry = registry.collected;
   };
 
-  util = import ./util.nix { inherit lib; };
+  util = import ./util { inherit lib; };
 
   registry = import ./registry.nix {
     inherit lib util;
diff --git a/src/dotfiles/util.nix b/src/dotfiles/util/default.nix
similarity index 94%
rename from src/dotfiles/util.nix
rename to src/dotfiles/util/default.nix
index 01c44ff..0615a04 100644
--- a/src/dotfiles/util.nix
+++ b/src/dotfiles/util/default.nix
@@ -21,8 +21,9 @@ let
     value: entries: builtins.length (lib.unique (map value entries)) == builtins.length entries;
 in
 {
-  inherit collectNixFiles;
+  formats.copyparty = import ./format-copyparty.nix { inherit lib; };
 
+  inherit collectNixFiles;
   removeNixSuffix = path: lib.removeSuffix ".nix" (builtins.baseNameOf path);
 
   glyph =
diff --git a/src/dotfiles/util/format-copyparty.nix b/src/dotfiles/util/format-copyparty.nix
new file mode 100644
index 0000000..4c5823d
--- /dev/null
+++ b/src/dotfiles/util/format-copyparty.nix
@@ -0,0 +1,58 @@
+{ lib }:
+let
+  renderLine =
+    indent: name: value:
+    if value == true then
+      "${indent}${name}"
+    else if value == false then
+      null
+    else if lib.isList value then
+      "${indent}${name}: ${lib.concatStringsSep ", " (map toString value)}"
+    else
+      "${indent}${name}: ${toString value}";
+
+  renderAttrs =
+    indent: attrs:
+    lib.pipe attrs [
+      lib.attrsToList
+      (map ({ name, value }: renderLine indent name value))
+      (lib.filter (line: line != null))
+      (lib.concatStringsSep "\n")
+    ];
+
+  renderSectionName = name: "[${lib.escape [ "[" "]" ] name}]";
+
+  renderSection = name: attrs: ''
+    ${renderSectionName name}
+    ${renderAttrs "" attrs}
+  '';
+
+  renderSubsection =
+    name: attrs:
+    lib.optionalString (attrs != { }) ''
+      ${name}:
+      ${renderAttrs "  " attrs}
+    '';
+
+  renderVolume = urlPath: volume: ''
+    ${renderSectionName urlPath}
+    ${volume.path}
+    ${renderSubsection "accs" volume.access}
+    ${renderSubsection "flags" volume.flags}
+  '';
+in
+{
+  render =
+    {
+      accounts,
+      global,
+      volumes,
+      globalExtraConfig ? "",
+    }:
+    ''
+      ${renderSection "global" global}
+      ${globalExtraConfig}
+      ${renderSection "accounts" accounts}
+      ${lib.concatStringsSep "\n" (lib.mapAttrsToList renderVolume volumes)}
+    '';
+}