From 8f26f8a3328bbff48d057ff4bf333dc2defaf7ae Mon Sep 17 00:00:00 2001
From: h7x4 <h7x4@nani.wtf>
Date: Fri, 31 Oct 2025 15:40:20 +0900
Subject: [PATCH] nixos/traefik: replace bash wrapper in `ExecStartPre`

---
 nixos/modules/services/web-servers/traefik.nix | 10 ++++------
 1 file changed, 4 insertions(+), 6 deletions(-)

diff --git a/nixos/modules/services/web-servers/traefik.nix b/nixos/modules/services/web-servers/traefik.nix
index 86534f291ee7..e1f1f73a15e8 100644
--- a/nixos/modules/services/web-servers/traefik.nix
+++ b/nixos/modules/services/web-servers/traefik.nix
@@ -130,12 +130,9 @@ in
       startLimitBurst = 5;
       serviceConfig = {
         EnvironmentFile = cfg.environmentFiles;
-        ExecStartPre = lib.optional (cfg.environmentFiles != [ ]) (
-          pkgs.writeShellScript "pre-start" ''
-            umask 077
-            ${pkgs.envsubst}/bin/envsubst -i "${staticConfigFile}" > "${finalStaticConfigFile}"
-          ''
-        );
+        ExecStartPre = lib.optional (
+          cfg.environmentFiles != [ ]
+        ) "${pkgs.envsubst}/bin/envsubst -i '${staticConfigFile}' -o '${finalStaticConfigFile}'";
         ExecStart = "${cfg.package}/bin/traefik --configfile=${finalStaticConfigFile}";
         Type = "simple";
         User = "traefik";
@@ -152,6 +149,7 @@ in
         ProtectSystem = "full";
         ReadWritePaths = [ cfg.dataDir ];
         RuntimeDirectory = "traefik";
+        RuntimeDirectoryMode = "0700";
         WorkingDirectory = cfg.dataDir;
       };
     };