config/hosts/yate/configuration.nix

@@ -6,5 +6,7 @@
     domain = "z9.ccchh.net";
   };
 
+  users.users.chaos.password = "yes";
+
   system.stateVersion = "23.11";
 }

config/hosts/yate/service.nix

@@ -12,17 +12,22 @@
       ExecStart = "${pkgs.yate}/bin/yate -c /etc/yate -e /etc/yate/share -Do";
       Type="simple";
       Restart="always";
+      Group="yate-config";
+      StateDirectory = "yate";
+      StateDirectoryMode = "0775";
       # ...
     };
     wantedBy = [ "default.target" ];
     requiredBy = [ "network.target" ]; 
-    preStart = "if mkdir -p /etc/yate
+    preStart = "if ! [ -d \"/var/lib/yate/.git\" ]
                 then
-                ${pkgs.git}/bin/git -C /etc/yate clone forgejo@git.hamburg.ccc.de:echtnurich/yate-config.git
-                ${pkgs.git}/bin/git -C /etc/yate pull
-                else
-                ${pkgs.git}/bin/git -C /etc/yate checkout -f origin/main
-                fi";
+                ${pkgs.git}/bin/git init /var/lib/yate
+                ${pkgs.git}/bin/git -C /var/lib/yate remote add origin forgejo@git.hamburg.ccc.de:echtnurich/yate-config.git
+                ${pkgs.git}/bin/git -C /var/lib/yate pull -f --set-upstream
+                echo \"New repo set up.\"
+                fi
+                ${pkgs.git}/bin/git -C /var/lib/yate fetch --all
+                ${pkgs.git}/bin/git -C /var/lib/yate checkout --track -f origin/master";
     # ...
   };
 }

config/hosts/yate/yate.nix

@@ -10,4 +10,12 @@
 
   # Just disable it for now.
   networking.firewall.enable = false;
+
+  users.groups.yate-config = {};
+  users.groups.yate-config.members = [ "colmema-deploy" "chaos" ];
+
+  environment.etc.yate.user = "root";
+  environment.etc.yate.group = "yate-config";
+  environment.etc.yate.mode = "0775";
+  environment.etc.yate.source = "/var/lib/yate";
 }