1 { pkgs, lib, config, hostName, ... }:
3 inherit (config.networking) domain;
4 inherit (config.security) gnupg;
5 inherit (config.services) nginx postgresql;
6 inherit (config.users) users groups;
10 systemd.sockets.miniflux = {
11 listenStreams = [ "/run/miniflux.sock" ];
12 wantedBy = [ "sockets.target" ];
13 socketConfig.SocketMode = "600";
14 socketConfig.SocketUser = nginx.user;
19 BASE_URL = "https://${srv}.${domain}"; # Base URL to generate HTML links and base path for cookies.
20 BATCH_SIZE = "3"; # Number of feeds to send to the queue for each interval.
21 CLEANUP_ARCHIVE_UNREAD_DAYS = "60";
22 CLEANUP_ARCHIVE_READ_DAYS = "30";
25 #METRICS_COLLECTOR = "1";
26 POLLING_FREQUENCY = "180";
27 POLLING_SCHEDULER = "entry_frequency";
28 SCHEDULER_ENTRY_FREQUENCY_MAX_INTERVAL = "10080"; # 7*24*60 = 7d
30 WORKER_POOL_SIZE = "2";
32 adminCredentialsFile = gnupg.secrets."miniflux/credentials".path;
34 security.gnupg.secrets."miniflux/credentials" = {};
35 systemd.services.miniflux = {
36 after = [ gnupg.secrets."miniflux/credentials".service ];
37 wants = [ gnupg.secrets."miniflux/credentials".service ];
38 # For the socket-activation
39 wantedBy = lib.mkForce [ ];
41 RefuseManualStart = true;
45 User = users."miniflux".name;
46 Group = groups."postgres".name;
49 "/run/systemd/journal/socket"
51 "/etc/pki/tls/certs/ca-bundle.crt"
55 DynamicUser = lib.mkForce false;
56 UMask = lib.mkForce "0022";
58 NoNewPrivileges = true;
61 #ProtectSystem = true;
69 services.postgresql.identMap = ''
70 # MAPNAME SYSTEM-USERNAME PG-USERNAME
71 user ${users.miniflux.name} ${users.miniflux.name}
73 users.users."miniflux" = {
75 group = groups."postgres".name;
77 services.nginx.virtualHosts."${srv}.${domain}" = {
81 access_log /var/log/nginx/${domain}/${srv}/access.log json buffer=32k;
82 error_log /var/log/nginx/${domain}/${srv}/error.log warn;
85 proxyPass = "http://unix:/run/miniflux.sock:/";
88 systemd.services.nginx.serviceConfig.LogsDirectory = lib.mkForce ["nginx/${domain}/${srv}"];