From c44769ff7089fcce646f3b1622fdcd1a27f309c4 Mon Sep 17 00:00:00 2001
From: alexion <contact@alexion.dev>
Date: Thu, 15 Oct 2026 14:13:07 -0400
Subject: [PATCH] refactor(steamcmd): constrain service names

---
 configs/nixos/AGENTS.md                     | 1 +
 configs/nixos/modules/services/steamcmd.nix | 8 ++++----
 2 files changed, 5 insertions(+), 4 deletions(-)

diff --git a/configs/nixos/AGENTS.md b/configs/nixos/AGENTS.md
index 50fe4fd..3e8450d 100644
--- a/configs/nixos/AGENTS.md
+++ b/configs/nixos/AGENTS.md
@@ -67,3 +67,4 @@
 - On Pikachu, `uptime` does not support `-s`. Use `who -b` to report the boot time.
 - Evaluating a NixOS guest's inner `config.services.nginx` can force incomplete ACME values.
   Evaluate the parent host's `config.system.build.toplevel` to validate an ACME-enabled guest.
+- `pkgs.systemd` does not set `meta.mainProgram`. Use `lib.getExe' pkgs.systemd "systemctl"` instead of `lib.getExe pkgs.systemd`.
diff --git a/configs/nixos/modules/services/steamcmd.nix b/configs/nixos/modules/services/steamcmd.nix
index fa104a7..fce072b 100644
--- a/configs/nixos/modules/services/steamcmd.nix
+++ b/configs/nixos/modules/services/steamcmd.nix
@@ -15,9 +15,9 @@
     };
 
     serviceName = lib.mkOption {
-      type = lib.types.str;
+      type = lib.types.strMatching "[a-z0-9][a-z0-9-]*";
       example = "valheim";
-      description = "Name of the systemd service that runs the game server.";
+      description = "Lowercase systemd service basename for the game server.";
     };
 
     appId = lib.mkOption {
@@ -87,7 +87,7 @@
         prepareScript = pkgs.writeShellScript "steamcmd-${service.serviceName}-prepare" ''
           set -eu
 
-          ${pkgs.coreutils}/bin/install -d \
+          ${lib.getExe' pkgs.coreutils "install"} -d \
             -o ${user} \
             -g ${group} \
             -m 0770 \
@@ -155,7 +155,7 @@
             wantedBy = lib.mkIf service.autoStart [ "multi-user.target" ];
             serviceConfig = {
               Type = "oneshot";
-              ExecStart = "${pkgs.systemd}/bin/systemctl --no-block start ${service.serviceName}.service";
+              ExecStart = "${lib.getExe' pkgs.systemd "systemctl"} --no-block start ${service.serviceName}.service";
             };
           };