From 29fe7f76c122934ca37ef6edae628c8387a4298f Mon Sep 17 00:00:00 2001
From: Abel Luck <abel@guardianproject.info>
Date: Fri, 27 Feb 2026 09:27:49 +0100
Subject: [PATCH] expand the path to support working in systemd service

---
 CHANGELOG.md              |  1 +
 internal/config/config.go | 27 +++++++++++++++++++++++++--
 package.nix               |  2 +-
 3 files changed, 27 insertions(+), 3 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 4deead8..7731311 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -4,6 +4,7 @@
 
 Changes yet to be released are documented here.
 
+- Fix path expansion when running in systemd
 - Add nixos, home-manager, and darwin-nix modules
 
 ## v0.1.0
diff --git a/internal/config/config.go b/internal/config/config.go
index 77faaa1..cc37736 100644
--- a/internal/config/config.go
+++ b/internal/config/config.go
@@ -37,8 +37,8 @@ func Load(path string) (*Config, error) {
 		return nil, fmt.Errorf("parsing config file: %w", err)
 	}
 
-	cfg.NetrcPath = os.ExpandEnv(cfg.NetrcPath)
-	cfg.ClientSecretFile = os.ExpandEnv(cfg.ClientSecretFile)
+	cfg.NetrcPath = expandPath(cfg.NetrcPath)
+	cfg.ClientSecretFile = expandPath(cfg.ClientSecretFile)
 
 	if cfg.ClientSecretFile != "" {
 		secret, err := os.ReadFile(cfg.ClientSecretFile)
@@ -71,6 +71,29 @@ func (c *Config) validate() error {
 	return nil
 }
 
+// expandPath expands environment variables in a path. XDG base directory
+// variables are resolved using the xdg library, which applies the XDG spec
+// fallbacks (e.g. $HOME/.config when $XDG_CONFIG_HOME is unset). This ensures
+// correct behaviour in systemd user services, which do not set XDG variables.
+func expandPath(s string) string {
+	return os.Expand(s, func(key string) string {
+		switch key {
+		case "XDG_CONFIG_HOME":
+			return xdg.ConfigHome
+		case "XDG_DATA_HOME":
+			return xdg.DataHome
+		case "XDG_CACHE_HOME":
+			return xdg.CacheHome
+		case "XDG_STATE_HOME":
+			return xdg.StateHome
+		case "XDG_RUNTIME_DIR":
+			return xdg.RuntimeDir
+		default:
+			return os.Getenv(key)
+		}
+	})
+}
+
 // RefreshTokenPath returns the path to the stored refresh token.
 func RefreshTokenPath() string {
 	return filepath.Join(xdg.ConfigHome, "nix-cache-login", "refresh-token")
diff --git a/package.nix b/package.nix
index cb25f28..e85a434 100644
--- a/package.nix
+++ b/package.nix
@@ -6,7 +6,7 @@
 
 buildGoModule {
   pname = "nix-cache-login";
-  version = "0.1.1";
+  version = "0.1.2";
   src = ./.;
   # src = fetchgit {
   #   url = "https://guardianproject.dev/ops/nix-cache-login.git";