From e16cc51781c3c7e1d215b1571536f7e9e84e5633 Mon Sep 17 00:00:00 2001
From: Marcel <me@m4rc3l.de>
Date: Sun, 16 Nov 2025 02:30:52 +0100
Subject: [PATCH] nixos/onlyoffice: require a user supplied nonce

Co-authored-by: Martin Weinelt <hexa@darmstadt.ccc.de>
(cherry picked from commit 5c2683eb21b27eb87759259a926be6c851aa583c)
---
 .../modules/services/web-apps/onlyoffice.nix  | 27 +++++--------------
 1 file changed, 7 insertions(+), 20 deletions(-)

diff --git a/nixos/modules/services/web-apps/onlyoffice.nix b/nixos/modules/services/web-apps/onlyoffice.nix
index 60621e97929e..d5db7b0aaa7d 100644
--- a/nixos/modules/services/web-apps/onlyoffice.nix
+++ b/nixos/modules/services/web-apps/onlyoffice.nix
@@ -7,10 +7,6 @@
 
 let
   cfg = config.services.onlyoffice;
-  defaultNginxNonceFileContent = "set $secure_link_secret \"mynonce\";";
-  defaultNginxNonceFile = pkgs.writeText "onlyoffice-nonce-nginx.conf" ''
-    ${defaultNginxNonceFileContent}
-  '';
 in
 {
   options.services.onlyoffice = {
@@ -26,17 +22,14 @@ in
 
     securityNonceFile = lib.mkOption {
       type = lib.types.str;
-      default = "${defaultNginxNonceFile}";
-      defaultText = lib.literalExpression ''
-        (pkgs.writeText "onlyoffice-nonce-nginx.conf" \'\'
-          ${defaultNginxNonceFileContent}
-        \'\').outPath;
-      '';
+      example = "/run/keys/onlyoffice-nginx-nonce.conf";
       description = ''
-        Path to a file that contains a secret to sign web requests.
-        This file should set a 'secure_link_secret' nginx variable,
-        and ideally be managed by a
-        [secret managing scheme](https://wiki.nixos.org/wiki/Comparison_of_secret_managing_schemes).
+        File holding nginx configuration that sets the nonce used to create secret links.
+
+        Example:
+        ```
+        set $secure_link_secret "changeme";
+        ```
       '';
     };
 
@@ -103,12 +96,6 @@ in
   };
 
   config = lib.mkIf cfg.enable {
-    warnings = [
-      (lib.optionalString (cfg.securityNonceFile == "${defaultNginxNonceFile}") ''
-        Please set `options.services.onlyoffice.securityNonceFile`
-        to avoid an (albeit unlikely) information disclosure issue.
-      '')
-    ];
     services = {
       nginx = {
         enable = lib.mkDefault true;