...

1 files changed, 10 insertions, 2 deletions

diff --git a/modules/certspotter.nix b/modules/certspotter.nix
index 4dee0d37..aae6a313 100644
--- a/modules/certspotter.nix
+++ b/modules/certspotter.nix
@@ -19,6 +19,15 @@ let
                  ++ ["-watchlist" (pkgs.writeText "watchlist" (concatStringsSep "\n" cfg.watchList))
                      "-script" "${script}/bin/certspotter-script"
                     ];
+
+  startScript = pkgs.writeShellApplication {
+    name = "certspotter-start";
+    runtimeInputs = [ pkgs.coreutils cfg.package ];
+    text = ''
+      rm -f "''${STATE_DIRECTORY}/lock"
+      certspotter -state_dir "''${STATE_DIRECTORY}" ${escapeShellArgs startOptions}
+    '';
+  };
 in {
   options = {
     services.certspotter = {
@@ -45,8 +54,7 @@ in {
     systemd.services.certspotter = {
       serviceConfig = {
         Type = "oneshot";
-        ExecStartPre = "${pkgs.coreutils}/bin/rm -f $STATE_DIRECTORY/lock";
-        ExecStart = "${cfg.package}/bin/certspotter -state_dir $STATE_DIRECTORY ${escapeShellArgs startOptions}";
+        ExecStart = "${startScript}/bin/certspotter-start";
         StateDirectory = "certspotter";
         LogsDirectory = "certspotter";
         DynamicUser = true;