From a7b149f58a59915a6fad5f57cd5ca6a4e02ed0ee Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Tue, 11 Aug 2026 03:11:02 +0000
Subject: [PATCH 1/2] Initial plan


From 1b6b1ade46fb7427a55d2cdd706d9ea2c622d1f7 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Tue, 11 Aug 2026 03:12:27 +0000
Subject: [PATCH 2/2] Fix BTCPay startup regression: add home dirs to service
 users

Co-authored-by: naturallaw777 <99053422+naturallaw777@users.noreply.github.com>
---
 modules/bitcoin/btcpayserver.nix   | 2 ++
 tests/bitcoin-btcpay-hardening.nix | 6 ++++++
 2 files changed, 8 insertions(+)

diff --git a/modules/bitcoin/btcpayserver.nix b/modules/bitcoin/btcpayserver.nix
index a07a667..4bad53b 100644
--- a/modules/bitcoin/btcpayserver.nix
+++ b/modules/bitcoin/btcpayserver.nix
@@ -196,6 +196,7 @@ in {
       users.users.${cfg.nbxplorer.user} = {
         isSystemUser = true;
         group = cfg.nbxplorer.group;
+        home = cfg.nbxplorer.dataDir;
       };
       users.groups.${cfg.nbxplorer.group} = {};
     })
@@ -295,6 +296,7 @@ in {
       users.users.${cfg.btcpayserver.user} = {
         isSystemUser = true;
         group = cfg.btcpayserver.group;
+        home = cfg.btcpayserver.dataDir;
         extraGroups = optional (cfg.btcpayserver.lightningBackend == "lnd") config.services.lnd.group;
       };
       users.groups.${cfg.btcpayserver.group} = {};
diff --git a/tests/bitcoin-btcpay-hardening.nix b/tests/bitcoin-btcpay-hardening.nix
index 818786f..1d8815b 100644
--- a/tests/bitcoin-btcpay-hardening.nix
+++ b/tests/bitcoin-btcpay-hardening.nix
@@ -57,6 +57,12 @@ let
   nbxplorerConfig = builtins.readFile nbxplorerConfigPath;
   btcpayConfig = builtins.readFile btcpayConfigPath;
 in
+assert lib.assertMsg
+  (config.users.users.${config.services.btcpayserver.user}.home == config.services.btcpayserver.dataDir)
+  "btcpayserver user home must match btcpayserver dataDir";
+assert lib.assertMsg
+  (config.users.users.${config.services.nbxplorer.user}.home == config.services.nbxplorer.dataDir)
+  "nbxplorer user home must match nbxplorer dataDir";
 assert lib.assertMsg
   (config.nix-bitcoin.secrets.bitcoin-HMAC-btcpayserver.user == config.services.bitcoind.user)
   "bitcoin-HMAC-btcpayserver must be owned by bitcoind";