From 70d81af82f5b31bb5cf25b68bddb13110a722d35 Mon Sep 17 00:00:00 2001
From: Alexander <alexander0derevianko@gmail.com>
Date: Mon, 18 May 2026 18:51:49 +0200
Subject: [PATCH] Support running service as real user to access home
 directories

- NixOS module conditionally applies restrictions based on user
- When user != 'backlog', disables ProtectHome and ProtectSystem
- Allows service to access ~/... paths when running as real user
- Update placeholder to show absolute path example
---
 nix/module.nix | 17 +++++++++--------
 1 file changed, 9 insertions(+), 8 deletions(-)

diff --git a/nix/module.nix b/nix/module.nix
index 9e83abf..cc13f27 100644
--- a/nix/module.nix
+++ b/nix/module.nix
@@ -8,6 +8,7 @@
 let
   cfg = config.services.personal-backlog;
   package = pkgs.callPackage ./package.nix { };
+  isDefaultUser = cfg.user == "backlog";
 in
 {
   options.services.personal-backlog = {
@@ -35,7 +36,7 @@ in
     user = lib.mkOption {
       type = lib.types.str;
       default = "backlog";
-      description = "User account under which the service runs.";
+      description = "User account under which the service runs. Set to your username to access home directories.";
     };
 
     group = lib.mkOption {
@@ -52,14 +53,14 @@ in
   };
 
   config = lib.mkIf cfg.enable {
-    users.users.${cfg.user} = {
+    users.users.${cfg.user} = lib.mkIf isDefaultUser {
       isSystemUser = true;
       group = cfg.group;
       home = cfg.dataDir;
       createHome = true;
     };
 
-    users.groups.${cfg.group} = { };
+    users.groups.${cfg.group} = lib.mkIf isDefaultUser { };
 
     systemd.services.personal-backlog = {
       description = "Personal Backlog Task Manager";
@@ -75,14 +76,14 @@ in
         Restart = "on-failure";
         RestartSec = 5;
 
-        StateDirectory = "personal-backlog";
-        StateDirectoryMode = "0750";
+        StateDirectory = lib.mkIf isDefaultUser "personal-backlog";
+        StateDirectoryMode = lib.mkIf isDefaultUser "0750";
 
         NoNewPrivileges = true;
-        ProtectSystem = "strict";
-        ProtectHome = true;
+        ProtectSystem = lib.mkIf isDefaultUser "strict";
+        ProtectHome = lib.mkIf isDefaultUser true;
         PrivateTmp = true;
-        ReadWritePaths = [ cfg.dataDir ];
+        ReadWritePaths = lib.mkIf isDefaultUser [ cfg.dataDir ];
       };
     };