diff --git a/configs/nixos/lib/copyparty-config.nix b/configs/nixos/lib/copyparty-config.nix
new file mode 100644
index 0000000..4c3a52a
--- /dev/null
+++ b/configs/nixos/lib/copyparty-config.nix
@@ -0,0 +1,65 @@
+{
+  lib,
+  pkgs,
+}:
+cfg:
+let
+  renderedReverseProxy = lib.optionalString cfg.reverseProxy.enable ''
+      rproxy: 1
+      xff-hdr: x-forwarded-for
+    ${lib.concatStringsSep "\n" (map renderTrustedSource cfg.reverseProxy.trustedSources)}
+  '';
+
+  renderTrustedSource = source: "  xff-src: ${source}";
+
+  renderedVolumes = lib.concatStringsSep "\n" (lib.mapAttrsToList renderVolume cfg.volumes);
+
+  renderVolume = urlPath: volume: ''
+    [${urlPath}]
+      ${volume.path}
+      accs:
+    ${lib.concatStringsSep "\n" (lib.mapAttrsToList renderAccess volume.access)}
+    ${lib.optionalString (volume.flags != [ ]) ''
+        flags:
+      ${renderFlags volume.flags}
+    ''}
+  '';
+
+  renderAccess = permission: accounts: "    ${permission}: ${lib.concatStringsSep ", " accounts}";
+
+  renderFlags =
+    flags: lib.concatMapStringsSep "\n" (flag: "    ${flag}") (flags ++ defaultPermissionFlags flags);
+
+  defaultPermissionFlags =
+    flags:
+    lib.optionals (!(hasFlag "chmod_d" flags)) [ "chmod_d: 2770" ]
+    ++ lib.optionals (!(hasFlag "chmod_f" flags)) [ "chmod_f: 660" ];
+
+  hasFlag =
+    name: flags: lib.any (flag: lib.hasPrefix "${name}:" flag || lib.hasPrefix "${name}=" flag) flags;
+in
+pkgs.writeShellScript "copyparty-config" ''
+  set -eu
+
+  umask 077
+  password="$(${lib.getExe' pkgs.coreutils "tr"} -d '\n' < "$CREDENTIALS_DIRECTORY/password")"
+
+  cat > /run/copyparty/copyparty.conf <<EOF
+  [global]
+    p: ${toString cfg.port}
+    usernames
+    http-only
+    no-crt
+    no-thumb
+    no-snap
+    no-rescan
+    ses-db: ${cfg.stateDir}/sessions.db
+    chpw-db: ${cfg.stateDir}/chpw.json
+    shr-db: ${cfg.stateDir}/shares.db
+  ${renderedReverseProxy}
+  [accounts]
+    ${cfg.accountName}: $password
+
+  ${renderedVolumes}
+  EOF
+''
diff --git a/configs/nixos/modules/services/copyparty.nix b/configs/nixos/modules/services/copyparty.nix
index 25c1459..174b394 100644
--- a/configs/nixos/modules/services/copyparty.nix
+++ b/configs/nixos/modules/services/copyparty.nix
@@ -7,95 +7,7 @@
 let
   cfg = config.modules.services.copyparty; # NOLINT(let_order)
 
-  volumeType = lib.types.submodule {
-    options = {
-      path = lib.mkOption {
-        type = lib.types.str;
-        description = "Filesystem path served by this volume.";
-      };
-
-      access = lib.mkOption {
-        type = lib.types.attrsOf (lib.types.listOf lib.types.str);
-        default = { };
-        example = {
-          A = [ "alexion" ];
-        };
-        description = "Copyparty access map from permission string to account names.";
-      };
-
-      readOnly = lib.mkOption {
-        type = lib.types.bool;
-        default = false;
-        description = "Serve this volume read-only.";
-      };
-
-      flags = lib.mkOption {
-        type = lib.types.listOf lib.types.str;
-        default = [ ];
-        example = [ "dthumb" ];
-        description = "Copyparty volume flags.";
-      };
-    };
-  };
-
-  configScript = pkgs.writeShellScript "copyparty-config" ''
-    set -eu
-
-    umask 077
-    password="$(${pkgs.coreutils}/bin/tr -d '\n' < "$CREDENTIALS_DIRECTORY/password")"
-
-    cat > /run/copyparty/copyparty.conf <<EOF
-    [global]
-      p: ${toString cfg.port}
-      usernames
-      http-only
-      no-crt
-      no-thumb
-      no-snap
-      no-rescan
-      ses-db: ${cfg.stateDir}/sessions.db
-      chpw-db: ${cfg.stateDir}/chpw.json
-      shr-db: ${cfg.stateDir}/shares.db
-    ${renderedReverseProxy}
-    [accounts]
-      ${cfg.accountName}: $password
-
-    ${renderedVolumes}
-    EOF
-  '';
-  renderAccess = permission: accounts: "    ${permission}: ${lib.concatStringsSep ", " accounts}";
-
-  hasFlag =
-    name: flags: lib.any (flag: lib.hasPrefix "${name}:" flag || lib.hasPrefix "${name}=" flag) flags;
-
-  defaultPermissionFlags =
-    flags:
-    lib.optionals (!(hasFlag "chmod_d" flags)) [ "chmod_d: 2770" ]
-    ++ lib.optionals (!(hasFlag "chmod_f" flags)) [ "chmod_f: 660" ];
-
-  renderFlags =
-    flags: lib.concatMapStringsSep "\n" (flag: "    ${flag}") (flags ++ defaultPermissionFlags flags);
-
-  renderVolume = urlPath: volume: ''
-    [${urlPath}]
-      ${volume.path}
-      accs:
-    ${lib.concatStringsSep "\n" (lib.mapAttrsToList renderAccess volume.access)}
-    ${lib.optionalString (volume.flags != [ ]) ''
-        flags:
-      ${renderFlags volume.flags}
-    ''}
-  '';
-
-  renderTrustedSource = source: "  xff-src: ${source}";
-
-  renderedReverseProxy = lib.optionalString cfg.reverseProxy.enable ''
-      rproxy: 1
-      xff-hdr: x-forwarded-for
-    ${lib.concatStringsSep "\n" (map renderTrustedSource cfg.reverseProxy.trustedSources)}
-  '';
-
-  renderedVolumes = lib.concatStringsSep "\n" (lib.mapAttrsToList renderVolume cfg.volumes);
+  configScript = (import ../../lib/copyparty-config.nix { inherit lib pkgs; }) cfg;
 
 in
 {
@@ -140,7 +52,38 @@ in
     };
 
     volumes = lib.mkOption {
-      type = lib.types.attrsOf volumeType;
+      type = lib.types.attrsOf (
+        lib.types.submodule {
+          options = {
+            path = lib.mkOption {
+              type = lib.types.externalPath;
+              description = "Filesystem path served by this volume.";
+            };
+
+            access = lib.mkOption {
+              type = lib.types.attrsOf (lib.types.listOf lib.types.str);
+              default = { };
+              example = {
+                A = [ "alexion" ];
+              };
+              description = "Copyparty access map from permission string to account names.";
+            };
+
+            readOnly = lib.mkOption {
+              type = lib.types.bool;
+              default = false;
+              description = "Serve this volume read-only.";
+            };
+
+            flags = lib.mkOption {
+              type = lib.types.listOf lib.types.str;
+              default = [ ];
+              example = [ "dthumb" ];
+              description = "Copyparty volume flags.";
+            };
+          };
+        }
+      );
       default = { };
       description = "Copyparty volumes keyed by their URL path.";
     };