fix

module.nix

@@ -150,6 +150,41 @@ in
         };
       };
 
+      services.mastodon-kanidm-sync = {
+        after = [
+          # "mastodon.service" # TODO: ??
+          "postgres.service"
+          "kanidm.service"
+        ];
+        requires = [
+          "kanidm.service"
+          "postgres.service"
+        ];
+        wantedBy = [ "multi-user.target" ];
+        environment = let db = config.services.mastodon.database;
+        in {
+          KANIDM_URL = config.services.kanidm.serverSettings.origin;
+          KANIDM_TOKEN_PATH = serviceAccountFP;
+          POSTGRES_DBNAME = db.name;
+          POSTGRES_USER = db.user;
+          POSTGRES_HOST = db.host;
+        };
+        serviceConfig = {
+          Slice = "mastodon.slice";
+          User = "mastodon";
+          Group = "mastodon";
+          LoadCredential = [ "kanidm-token:${serviceAccountFP}" ];
+          ExecStart = pkgs.writers.writePython3 "mas-kanidm-sync" {
+            doCheck = false;
+            libraries = with pkgs.python3Packages; [
+              requests
+              psycopg
+              python-ulid
+            ];
+          } (builtins.readFile ./mas-kanidm-sync.py);
+        };
+      };
+
       services.mastodon-web = {
         unitConfig.RequiresMountsFor = lib.mkIf sp.useBinds "/volumes/${cfg.location}/mastodon";
         serviceConfig = {