infrastructure

commit 60e9e2184534a98b6c909d78c170bea55a1ff2c6
parent 9d7ac558513bb424f6f7aab916c68bfa0ed8213b
Author: Silas Brack <silasbrack@gmail.com>
Date:   Fri, 12 Jun 2026 22:49:53 +0200

fix: bind-mount volume into state dir for DynamicUser access

DynamicUser can't write to volume paths directly. Bind-mount
/mnt/volume-hel1-1/simple-web-app/data into /var/lib/simple-web-app/data
so the dynamic user has write access via StateDirectory while data
lives on the Hetzner volume.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Diffstat:
M
modules/simple-web-app.nix
 | 
5
++---

1 file changed, 2 insertions(+), 3 deletions(-)
diff --git a/modules/simple-web-app.nix b/modules/simple-web-app.nix
@@ -30,7 +30,7 @@ in
 
       dbPath = mkOption {
         type = types.str;
-        default = "/mnt/volume-hel1-1/simple-web-app/data/app.db";
+        default = "/var/lib/simple-web-app/data/app.db";
         description = ''
           Path to the SQLite database file.
         '';
@@ -58,13 +58,12 @@ in
         DynamicUser = true;
         StateDirectory = "simple-web-app";
         StateDirectoryMode = "0755";
-        ReadWritePaths = [ "/mnt/volume-hel1-1/simple-web-app" ];
         ExecStartPre = let
           setupScript = pkgs.writeShellScript "simple-web-app-setup" ''
             mkdir -p /mnt/volume-hel1-1/simple-web-app/data
-            chmod 755 /mnt/volume-hel1-1/simple-web-app/data
           '';
         in "+${setupScript}";
+        BindPaths = [ "/mnt/volume-hel1-1/simple-web-app/data:/var/lib/simple-web-app/data" ];
       };
       environment = {
         PORT = builtins.toString cfg.port;