modules/system/homelab/docs.nix

@@ -3,10 +3,6 @@
   sandbox = "docs-sandbox.${homelab.domain}";
   data-dir = "/mnt/data/apps/cryptpad";
 in {
-  systemd.tmpfiles.rules = [
-    "d ${data-dir} 0750 cryptpad cryptpad -"
-  ];
-
   services.cryptpad = {
     enable = true;
     settings = {
@@ -27,5 +23,8 @@ in {
     };
   };
   
-  systemd.services.cryptpad.serviceConfig.ReadWritePaths = [ data-dir ];
+  systemd.services.cryptpad.serviceConfig = {
+    ReadWritePaths = [ data-dir ];
+    ProtectMountPoints = false;
+  };
 }

modules/system/homelab/proxy.nix

@@ -21,6 +21,7 @@ in {
     certs."${homelab.proxy.base}" = {
       domain = "*.${homelab.proxy.base}";
       extraDomainNames = [ homelab.proxy.base ];
+      directory = "/mnt/data/apps/acme/${homelab.proxy.base}";
       environmentFile = "/mnt/data/apps/acme/cf-api.env";
       dnsProvider = "cloudflare";
       # ^^^contents: CLOUDFLARE_DNS_API_TOKEN=XXXXX