certspotter: switch to using StateDirectory

system/hosts/server/default.nix

@@ -228,14 +228,22 @@ in {
       type = "postgres";
     };
     settings = {
+      federation.ENABLED = true;
+      "git.timeout" = {
+        DEFAULT = 6000;
+        MIGRATE = 6000;
+        MIRROR = 6000;
+        GC = 120;
+      };
       mailer = {
         ENABLED = true;
         FROM = "Forgejo <noreply@${cfg.domainName}>";
-        MAILER_TYPE = "smtp";
+        PROTOCOL = "smtp";
-        HOST = "mail.${cfg.domainName}:587";
+        SMTP_ADDR = "mail.${cfg.domainName}";
+        SMTP_PORT = 587;
         USER = "noreply@${cfg.domainName}";
         PASSWD = cfg.unhashedNoreplyPassword;
-        SKIP_VERIFY = true;
+        FORCE_TRUST_SERVER_CERT = true;
       };
       session = {
         COOKIE_SECURE = true;

system/modules/certspotter.nix

@@ -100,13 +100,16 @@ in {
             name = "hook${toString i}";
           }) cfg.hooks);
         });
-      environment.CERTSPOTTER_STATE_DIR = "/var/lib/certspotter";
       serviceConfig = {
         User = "certspotter";
         Group = "certspotter";
-        WorkingDirectory = "/var/lib/certspotter";
+        StateDirectory = "certspotter";
-        ExecStart = "${pkgs.certspotter}/bin/certspotter -sendmail ${cfg.sendmailPath} ${lib.escapeShellArgs cfg.extraFlags}";
       };
+      script = ''
+        export CERTSPOTTER_STATE_DIR="$STATE_DIR"
+        cd "$CERTSPOTTER_STATE_DIR"
+        ${pkgs.certspotter}/bin/certspotter -sendmail ${cfg.sendmailPath} ${lib.escapeShellArgs cfg.extraFlags}
+      '';
     };
   };
 }