Convert miniflux to systemd socket activation

Fixes socket permission issue. Drop the RuntimeDirectoryMode workaround:
nginx no longer traverses /run/miniflux.

Also drop the now-redundant explicit socket dependencies from bjj-booker
and clippersnip; systemd adds those implicitly.

1 files changed, 14 insertions, 5 deletions

diff --git a/hostnix/elmo/rss.nix b/hostnix/elmo/rss.nix
index 61e3cc5..de611a9 100644
--- a/hostnix/elmo/rss.nix
+++ b/hostnix/elmo/rss.nix
@@ -1,4 +1,4 @@
-{ lib, ... }:
+{ ... }:
 
 {
   services.miniflux = {
@@ -6,18 +6,27 @@
     config = {
       BASE_URL = "https://mf.mou.fo";
       CREATE_ADMIN = 0;
-      LISTEN_ADDR = "/run/miniflux/miniflux.sock";
     };
   };
 
-  # https://github.com/NixOS/nixpkgs/issues/177284
-  systemd.services.miniflux.serviceConfig.RuntimeDirectoryMode = lib.mkForce "0755";
+  # https://github.com/miniflux/website/blob/main/content/docs/howto.md#systemd-socket-activation
+  systemd.sockets.miniflux = {
+    wantedBy = [ "sockets.target" ];
+    socketConfig = {
+      ListenStream = "/run/miniflux.sock";
+      SocketGroup = "nginx";
+      SocketMode = "0660";
+      NoDelay = true;
+    };
+  };
+
+  systemd.services.miniflux.serviceConfig.NonBlocking = true;
 
   services.nginx.virtualHosts."mf.mou.fo" = {
     enableACME = true;
     forceSSL = true;
     locations."/" = {
-      proxyPass = "http://unix:/run/miniflux/miniflux.sock";
+      proxyPass = "http://unix:/run/miniflux.sock";
     };
   };