refactor(steamcmd): constrain service names

configs/nixos/AGENTS.md

@@ -67,3 +67,4 @@
 - On Pikachu, `uptime` does not support `-s`. Use `who -b` to report the boot time.
 - Evaluating a NixOS guest's inner `config.services.nginx` can force incomplete ACME values.
   Evaluate the parent host's `config.system.build.toplevel` to validate an ACME-enabled guest.
+- `pkgs.systemd` does not set `meta.mainProgram`. Use `lib.getExe' pkgs.systemd "systemctl"` instead of `lib.getExe pkgs.systemd`.

configs/nixos/modules/services/steamcmd.nix

@@ -15,9 +15,9 @@
     };
 
     serviceName = lib.mkOption {
-      type = lib.types.str;
+      type = lib.types.strMatching "[a-z0-9][a-z0-9-]*";
       example = "valheim";
-      description = "Name of the systemd service that runs the game server.";
+      description = "Lowercase systemd service basename for the game server.";
     };
 
     appId = lib.mkOption {
@@ -87,7 +87,7 @@
         prepareScript = pkgs.writeShellScript "steamcmd-${service.serviceName}-prepare" ''
           set -eu
 
-          ${pkgs.coreutils}/bin/install -d \
+          ${lib.getExe' pkgs.coreutils "install"} -d \
             -o ${user} \
             -g ${group} \
             -m 0770 \
@@ -155,7 +155,7 @@
             wantedBy = lib.mkIf service.autoStart [ "multi-user.target" ];
             serviceConfig = {
               Type = "oneshot";
-              ExecStart = "${pkgs.systemd}/bin/systemctl --no-block start ${service.serviceName}.service";
+              ExecStart = "${lib.getExe' pkgs.systemd "systemctl"} --no-block start ${service.serviceName}.service";
             };
           };