From b4a9fa903f5b343d4219c4c3ef18728ccc3a10d6 Mon Sep 17 00:00:00 2001
From: Guanran Wang <guanran928@outlook.com>
Date: Tue, 2 Jan 2024 17:45:55 +0800
Subject: [PATCH] nixos/clash: use systemd DynamicUser

---
 nixos/modules/services/clash.nix              | 17 +++--------------
 nixos/profiles/common/opt-in/impermanence.nix |  1 -
 2 files changed, 3 insertions(+), 15 deletions(-)

diff --git a/nixos/modules/services/clash.nix b/nixos/modules/services/clash.nix
index 97d1d11..ca9473b 100644
--- a/nixos/modules/services/clash.nix
+++ b/nixos/modules/services/clash.nix
@@ -39,13 +39,6 @@ in {
   };
 
   config = lib.mkIf cfg.enable {
-    ### User running clash
-    users.groups."clash" = {};
-    users.users."clash" = {
-      isSystemUser = true;
-      group = config.users.groups."clash".name;
-    };
-
     ### systemd service
     # https://en.clash.wiki/introduction/service.html#systemd
     # https://wiki.metacubex.one/startup/service/#systemd
@@ -54,17 +47,13 @@ in {
       after = ["network-online.target"];
       wantedBy = ["multi-user.target"];
       serviceConfig = {
-        # TODO: DynamicUser
-        # DynamicUser = true;
-        User = config.users.users."clash".name;
-        Group = config.users.groups."clash".name;
-
         # https://man.archlinux.org/man/systemd.exec.5
-        ConfigurationDirectory = "clash";
+        DynamicUser = true;
+        StateDirectory = "clash";
         LoadCredential = "configuration:${cfg.configFile}";
         ExecStart = builtins.replaceStrings ["\n"] [" "] ''
           ${lib.getExe cfg.package}
-          -d /etc/clash
+          -d /var/lib/private/clash
           ${lib.optionalString (cfg.configFile != null) "-f \${CREDENTIALS_DIRECTORY}/configuration"}
           ${lib.optionalString (cfg.webui != null) "-ext-ui ${cfg.webui}"}
           ${lib.optionalString (cfg.extraOpts != null) cfg.extraOpts}
diff --git a/nixos/profiles/common/opt-in/impermanence.nix b/nixos/profiles/common/opt-in/impermanence.nix
index 898a6c9..412b787 100644
--- a/nixos/profiles/common/opt-in/impermanence.nix
+++ b/nixos/profiles/common/opt-in/impermanence.nix
@@ -9,7 +9,6 @@
       "/var/log"
       "/var/lib"
 
-      "/etc/clash" # clash
       "/etc/secureboot" # sbctl, lanzaboote
     ];
     files = [