Convert miniflux to systemd socket activation

Fixes socket permission issue. Drop the RuntimeDirectoryMode workaround:
nginx no longer traverses /run/miniflux.

Also drop the now-redundant explicit socket dependencies from bjj-booker
and clippersnip; systemd adds those implicitly.

3 files changed, 14 insertions, 9 deletions

diff --git a/hostnix/elmo/bjj-booker.nix b/hostnix/elmo/bjj-booker.nix
index 817940a..39dd44d 100644
--- a/hostnix/elmo/bjj-booker.nix
+++ b/hostnix/elmo/bjj-booker.nix
@@ -15,8 +15,6 @@
   };
 
   systemd.services.bjj-booker = {
-    requires = [ "bjj-booker.socket" ];
-    after = [ "bjj-booker.socket" ];
     environment.GYMDESK_EMAIL = "nyc@mou.fo";
     serviceConfig = {
       Type = "exec";
diff --git a/hostnix/elmo/clippersnip.nix b/hostnix/elmo/clippersnip.nix
index 93c1011..5f3efc5 100644
--- a/hostnix/elmo/clippersnip.nix
+++ b/hostnix/elmo/clippersnip.nix
@@ -16,8 +16,6 @@
   };
 
   systemd.services.clippersnip = {
-    requires = [ "clippersnip.socket" ];
-    after = [ "clippersnip.socket" ];
     path = [ pkgs.ffmpeg-headless ];
     environment.CLIPS_DIR = "/var/lib/clippersnip";
     serviceConfig = {
diff --git a/hostnix/elmo/rss.nix b/hostnix/elmo/rss.nix
index 61e3cc5..de611a9 100644
--- a/hostnix/elmo/rss.nix
+++ b/hostnix/elmo/rss.nix
@@ -1,4 +1,4 @@
-{ lib, ... }:
+{ ... }:
 
 {
   services.miniflux = {
@@ -6,18 +6,27 @@
     config = {
       BASE_URL = "https://mf.mou.fo";
       CREATE_ADMIN = 0;
-      LISTEN_ADDR = "/run/miniflux/miniflux.sock";
     };
   };
 
-  # https://github.com/NixOS/nixpkgs/issues/177284
-  systemd.services.miniflux.serviceConfig.RuntimeDirectoryMode = lib.mkForce "0755";
+  # https://github.com/miniflux/website/blob/main/content/docs/howto.md#systemd-socket-activation
+  systemd.sockets.miniflux = {
+    wantedBy = [ "sockets.target" ];
+    socketConfig = {
+      ListenStream = "/run/miniflux.sock";
+      SocketGroup = "nginx";
+      SocketMode = "0660";
+      NoDelay = true;
+    };
+  };
+
+  systemd.services.miniflux.serviceConfig.NonBlocking = true;
 
   services.nginx.virtualHosts."mf.mou.fo" = {
     enableACME = true;
     forceSSL = true;
     locations."/" = {
-      proxyPass = "http://unix:/run/miniflux/miniflux.sock";
+      proxyPass = "http://unix:/run/miniflux.sock";
     };
   };