···192192 ++ data.extraLegoRenewFlags
193193 );
194194195195+ # We need to collect all the ACME webroots to grant them write
196196+ # access in the systemd service.
197197+ webroots =
198198+ lib.remove null
199199+ (lib.unique
200200+ (builtins.map
201201+ (certAttrs: certAttrs.webroot)
202202+ (lib.attrValues config.security.acme.certs)));
195203 in {
196204 inherit accountHash cert selfsignedDeps;
197205···287295 "acme/.lego/${cert}/${certDir}"
288296 "acme/.lego/accounts/${accountHash}"
289297 ];
298298+299299+ ReadWritePaths = commonServiceConfig.ReadWritePaths ++ webroots;
290300291301 # Needs to be space separated, but can't use a multiline string because that'll include newlines
292302 BindPaths = [
···11{ mkDerivation, lib, fetchFromGitHub, cmake
22-, qtbase, qttools, sqlite, wrapGAppsHook }:
22+, qtbase, qttools, sqlcipher, wrapGAppsHook }:
3344mkDerivation rec {
55 pname = "sqlitebrowser";
···1616 # but qscintilla is currently in a bit of a mess as some consumers expect a
1717 # -qt4 or -qt5 prefix while others do not.
1818 # We *really* should get that cleaned up.
1919- buildInputs = [ qtbase sqlite ];
1919+ buildInputs = [ qtbase sqlcipher ];
20202121 nativeBuildInputs = [ cmake qttools wrapGAppsHook ];
2222+2323+ cmakeFlags = [
2424+ "-Dsqlcipher=1"
2525+ ];
22262327 meta = with lib; {
2428 description = "DB Browser for SQLite";