From df590320f3f282ed2a9bdaad200004b73942919a Mon Sep 17 00:00:00 2001
From: uku <hi@uku.moe>
Date: Sun, 12 Jul 2026 10:32:34 +0200
Subject: [PATCH 1/2] nixos/matrix-authentication-service: use env var instead
 of %d

%d works in the context of the ExecStart command, since it's expanded by
systemd. However, extraConfigFiles is also used in the ExecStartPre
*script*, and bash does not know what %d is, so it's not expanded and
the MAS config check fails because it can't find "%d/config-0" (instead
of the intended "/run/credentials/...")
---
 .../modules/services/matrix/matrix-authentication-service.nix | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/nixos/modules/services/matrix/matrix-authentication-service.nix b/nixos/modules/services/matrix/matrix-authentication-service.nix
index 4b57643e4090..ee3c1a5d8232 100644
--- a/nixos/modules/services/matrix/matrix-authentication-service.nix
+++ b/nixos/modules/services/matrix/matrix-authentication-service.nix
@@ -45,7 +45,9 @@ let
       pruned;
   configFile = format.generate "config.yaml" finalSettings;
 
-  extraConfigFiles = lib.imap0 (i: _: "%d/config-${toString i}") cfg.extraConfigFiles;
+  extraConfigFiles = lib.imap0 (
+    i: _: "\${CREDENTIALS_DIRECTORY}/config-${toString i}"
+  ) cfg.extraConfigFiles;
   runtimeConfig = "/run/matrix-authentication-service/config.yaml";
 in
 {

From 9c71adbeb55d14bb7463b5d0fa3d273249f70a8b Mon Sep 17 00:00:00 2001
From: uku <hi@uku.moe>
Date: Sun, 12 Jul 2026 22:53:39 +0200
Subject: [PATCH 2/2] nixos/tests/matrix-authentication-service: use
 extraConfigFiles

nixos/tests/matrix-authentication-service: use extraConfigFiles
---
 .../matrix/matrix-authentication-service.nix  | 25 ++++++++++++-------
 1 file changed, 16 insertions(+), 9 deletions(-)

diff --git a/nixos/tests/matrix/matrix-authentication-service.nix b/nixos/tests/matrix/matrix-authentication-service.nix
index 9194b1fc56cd..19900b5a9c18 100644
--- a/nixos/tests/matrix/matrix-authentication-service.nix
+++ b/nixos/tests/matrix/matrix-authentication-service.nix
@@ -189,11 +189,26 @@ in
       { nodes, ... }:
       let
         bundle = mkBundle masDomain;
+
+        extraConfig = pkgs.writeText "masExtraConfig.yml" (
+          builtins.toJSON {
+            secrets = {
+              encryption_file = "/var/lib/matrix-authentication-service/encryption";
+              keys = [
+                {
+                  kid = "rsa-4096";
+                  key_file = "/var/lib/matrix-authentication-service/key_rsa_4096";
+                }
+              ];
+            };
+          }
+        );
       in
       {
         services.matrix-authentication-service = {
           enable = true;
           createDatabase = true;
+          extraConfigFiles = [ (toString extraConfig) ];
           settings = {
             http = {
               public_base = "https://${masDomain}:8080/";
@@ -223,15 +238,7 @@ in
               secret_file = "/var/lib/matrix-authentication-service/matrix_secret";
             };
             database.uri = "postgresql:///matrix-authentication-service?host=/run/postgresql&user=matrix-authentication-service";
-            secrets = {
-              encryption_file = "/var/lib/matrix-authentication-service/encryption";
-              keys = [
-                {
-                  kid = "rsa-4096";
-                  key_file = "/var/lib/matrix-authentication-service/key_rsa_4096";
-                }
-              ];
-            };
+            # secrets is defined in extraConfigFiles
             policy.data.client_registration.allow_insecure_uris = true;
             upstream_oauth2.providers = [
               {