if isMorPLocate then let toFlags = x: <del> optional (cfg.${x} != [ ]) "--${lib.toLower x} '${concatStringsSep " " cfg.${x}}'"; args = concatLists (map toFlags [ "pruneFS" "pruneNames" "prunePaths" ]); </del> <ins> lib.optional (cfg.${x} != [ ]) "--${lib.toLower x} '${lib.concatStringsSep " " cfg.${x}}'"; args = lib.concatLists (map toFlags [ "pruneFS" "pruneNames" "prunePaths" ]); </ins> in '' exec ${cfg.package}/bin/updatedb  <del> --output ${toString cfg.output} ${concatStringsSep " " args}  </del> <ins> --output ${toString cfg.output} ${lib.concatStringsSep " " args}  </ins> --prune-bind-mounts ${if cfg.pruneBindMounts then "yes" else "no"}  <del> ${concatStringsSep " " cfg.extraFlags} </del> <ins> ${lib.concatStringsSep " " cfg.extraFlags} </ins> '' else '' exec ${cfg.package}/bin/updatedb  <del> ${optionalString (cfg.localuser != null && !isMorPLocate) "--localuser=${cfg.localuser}"}  --output=${toString cfg.output} ${concatStringsSep " " cfg.extraFlags} </del> <ins> ${lib.optionalString (cfg.localuser != null && !isMorPLocate) "--localuser=${cfg.localuser}"}  --output=${toString cfg.output} ${lib.concatStringsSep " " cfg.extraFlags} </ins> ''; <del> environment = optionalAttrs (!isMorPLocate) { PRUNEFS = concatStringsSep " " cfg.pruneFS; PRUNEPATHS = concatStringsSep " " cfg.prunePaths; PRUNENAMES = concatStringsSep " " cfg.pruneNames; </del> <ins> environment = lib.optionalAttrs (!isMorPLocate) { PRUNEFS = lib.concatStringsSep " " cfg.pruneFS; PRUNEPATHS = lib.concatStringsSep " " cfg.prunePaths; PRUNENAMES = lib.concatStringsSep " " cfg.pruneNames; </ins> PRUNE_BIND_MOUNTS = if cfg.pruneBindMounts then "yes" else "no"; }; <del> serviceConfig.Nice = 19; serviceConfig.IOSchedulingClass = "idle"; serviceConfig.PrivateTmp = "yes"; serviceConfig.PrivateNetwork = "yes"; serviceConfig.NoNewPrivileges = "yes"; serviceConfig.ReadOnlyPaths = "/"; # Use dirOf cfg.output because mlocate creates temporary files next to # the actual database. We could specify and create them as well, # but that would make this quite brittle when they change something. # NOTE: If /var/cache does not exist, this leads to the misleading error message: # update-locatedb.service: Failed at step NAMESPACE spawning …/update-locatedb-start: No such file or directory serviceConfig.ReadWritePaths = dirOf cfg.output; </del> <ins> serviceConfig = { Nice = 19; IOSchedulingClass = "idle"; PrivateTmp = "yes"; PrivateNetwork = "yes"; NoNewPrivileges = "yes"; ReadOnlyPaths = "/"; # Use dirOf cfg.output because mlocate creates temporary files next to # the actual database. We could specify and create them as well, # but that would make this quite brittle when they change something. # NOTE: If /var/cache does not exist, this leads to the misleading error message: # update-locatedb.service: Failed at step NAMESPACE spawning …/update-locatedb-start: No such file or directory ReadWritePaths = dirOf cfg.output; }; </ins> }; <del> systemd.timers.update-locatedb = mkIf (cfg.interval != "never") { </del> <ins> systemd.timers.update-locatedb = lib.mkIf (cfg.interval != "never") { </ins> description = "Update timer for locate database"; partOf = [ "update-locatedb.service" ]; wantedBy = [ "timers.target" ];