diff options
| author | Martin Weinelt <mweinelt@users.noreply.github.com> | 2024-05-13 10:12:37 +0200 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2024-05-13 10:12:37 +0200 |
| commit | 9731a32d8176e3d3bb3cf7b73b985a657c9ae6a5 (patch) | |
| tree | 4855d656b4fa69c2412a49f70aab8185d738e37a /nixos | |
| parent | fa8184ddcbb52042464f73d56bdb4d5a5c4571c3 (diff) | |
| parent | 212c34f8c024a76d1cfe9b737b020c0a94c583b0 (diff) | |
Merge pull request #309115 from NyCodeGHG/nixos/miniflux-sd-notify
nixos/miniflux: use systemd notify and watchdog
Diffstat (limited to 'nixos')
| -rw-r--r-- | nixos/modules/services/web-apps/miniflux.nix | 15 |
1 files changed, 11 insertions, 4 deletions
diff --git a/nixos/modules/services/web-apps/miniflux.nix b/nixos/modules/services/web-apps/miniflux.nix index d65d6db3cdaaa..61243a63c582e 100644 --- a/nixos/modules/services/web-apps/miniflux.nix +++ b/nixos/modules/services/web-apps/miniflux.nix @@ -1,7 +1,7 @@ { config, lib, pkgs, ... }: -with lib; let + inherit (lib) mkEnableOption mkPackageOption mkOption types literalExpression mkIf mkDefault; cfg = config.services.miniflux; defaultAddress = "localhost:8080"; @@ -20,8 +20,8 @@ in package = mkPackageOption pkgs "miniflux" { }; - createDatabaseLocally = lib.mkOption { - type = lib.types.bool; + createDatabaseLocally = mkOption { + type = types.bool; default = true; description = '' Whether a PostgreSQL database should be automatically created and @@ -66,6 +66,7 @@ in DATABASE_URL = lib.mkIf cfg.createDatabaseLocally "user=miniflux host=/run/postgresql dbname=miniflux"; RUN_MIGRATIONS = 1; CREATE_ADMIN = 1; + WATCHDOG = 1; }; services.postgresql = lib.mkIf cfg.createDatabaseLocally { @@ -96,12 +97,18 @@ in ++ lib.optionals cfg.createDatabaseLocally [ "postgresql.service" "miniflux-dbsetup.service" ]; serviceConfig = { - ExecStart = "${cfg.package}/bin/miniflux"; + Type = "notify"; + ExecStart = lib.getExe cfg.package; User = "miniflux"; DynamicUser = true; RuntimeDirectory = "miniflux"; RuntimeDirectoryMode = "0750"; EnvironmentFile = cfg.adminCredentialsFile; + WatchdogSec = 60; + WatchdogSignal = "SIGKILL"; + Restart = "always"; + RestartSec = 5; + # Hardening CapabilityBoundingSet = [ "" ]; DeviceAllow = [ "" ]; |