hmm

modules/nixos/services/nextcloud/default.nix

@@ -149,6 +149,35 @@ let
           nextcloud-setup = {
             after = [ "postgresql.service" ];
             requires = [ "postgresql.service" ];
+            serviceConfig =
+              let
+                # Extract the override.config.php store-path from the already-evaluated
+                # tmpfiles rules list at Nix eval time, so we never have to parse files at
+                # runtime. The upstream module emits exactly one rule of the form:
+                #   "L+ <dest> - - - - <storepath>"
+                overrideLine = lib.findFirst (
+                  r: lib.hasInfix "override.config.php" r
+                ) null config.systemd.tmpfiles.rules;
+                overrideStorePath =
+                  if overrideLine != null then lib.last (lib.splitString " " overrideLine) else null;
+              in
+              lib.mkIf (overrideStorePath != null) {
+                # systemd-tmpfiles refuses to create the override.config.php symlink because
+                # /media/nas/main is owned by nix-apps (not root/nextcloud), triggering an
+                # "unsafe path transition" error.  Work around this by creating the symlink
+                # directly as root (the '+' prefix) before the setup script's ownership check.
+                # The target store path is resolved at Nix eval time so it is always current.
+                ExecStartPre = [
+                  (
+                    "+"
+                    + pkgs.writeShellScript "nextcloud-fix-override-config" ''
+                      dest="${cfg.dataDir}/nextcloud/config/override.config.php"
+                      echo "Creating symlink: $dest -> ${overrideStorePath}"
+                      ${pkgs.coreutils}/bin/ln -sf "${overrideStorePath}" "$dest"
+                    ''
+                  )
+                ];
+              };
           };
           nextcloud-update-db = {
             after = [ "postgresql.service" ];