From c43605f627f193d2bd3c14e6c84c639737bbdff3 Mon Sep 17 00:00:00 2001
From: blake <me@blakedheld.xyz>
Date: Wed, 8 Oct 2025 10:52:06 -0500
Subject: [PATCH] 79 current  2025-10-08 00:28:08  25.05.20251001.5b5be50 
 6.12.49                          *

---
 .../services/arr/flaresolverr/default.nix     |  2 +-
 modules/homelab/services/default.nix.template | 26 +++++++++++--------
 2 files changed, 16 insertions(+), 12 deletions(-)

diff --git a/modules/homelab/services/arr/flaresolverr/default.nix b/modules/homelab/services/arr/flaresolverr/default.nix
index 35fc4ea..12fa26b 100644
--- a/modules/homelab/services/arr/flaresolverr/default.nix
+++ b/modules/homelab/services/arr/flaresolverr/default.nix
@@ -44,7 +44,7 @@ in
     services.flaresolverr = {
       enable = true;
       openFirewall = true;
-      port = cfg.port
+      port = cfg.port;
     };
 
     # override umask to make permissions work out
diff --git a/modules/homelab/services/default.nix.template b/modules/homelab/services/default.nix.template
index 1cbe84d..2d5c019 100644
--- a/modules/homelab/services/default.nix.template
+++ b/modules/homelab/services/default.nix.template
@@ -53,7 +53,11 @@ in
     };
 
     # override umask to make permissions work out
-    systemd.services.<service_name>.serviceConfig = { UMask = lib.mkForce "0007"; };
+    systemd.services.<service_name>.serviceConfig = {
+      UMask = lib.mkForce "0007";
+#      User = "<service_name>";
+#      Group = "<service_name>";
+    };
 
 #    # open firewall
 #    networking.firewall.allowedTCPPorts = [ cfg.port ];
@@ -68,16 +72,16 @@ in
         proxyPass = "http://127.0.0.1:${toString cfg.port}";
       };
     };
-     # external reverse proxy entry
-     services.nginx.virtualHosts."<service_name>.blakedheld.xyz" = {
-      enableACME = false;
-      forceSSL = true;
-      sslCertificate = config.sops.secrets."ssl_blakedheld_crt".path;
-      sslCertificateKey = config.sops.secrets."ssl_blakedheld_key".path;
-      locations."/" = {
-        proxyPass = "http://127.0.0.1:${toString cfg.port}";
-      };
-    };
+#     # external reverse proxy entry
+#     services.nginx.virtualHosts."<service_name>.blakedheld.xyz" = {
+#      enableACME = false;
+#      forceSSL = true;
+#      sslCertificate = config.sops.secrets."ssl_blakedheld_crt".path;
+#      sslCertificateKey = config.sops.secrets."ssl_blakedheld_key".path;
+#      locations."/" = {
+#        proxyPass = "http://127.0.0.1:${toString cfg.port}";
+#      };
+#    };
 
     sops.secrets = {
       "<service_name>_" = {