tt-rss: make code immutable

[telotortium]

Currently, the tt-rss service copies all its code from the Nix store into /var/lib/tt-rss upon startup. Thus, the installation's code can be overwritten by the tt_rss user itself, and be edited by users outside of the Nix store (although changes to the wrong directories will be overwritten upon service restart). This should be changed to make the code immutable as much as possible. See this recent thread on containerizing a TT-RSS installation: https://discourse.tt-rss.org/t/overhaul-ttrss-needs-a-data-directory/1922/19

[stale]

Thank you for your contributions.

This has been automatically marked as stale because it has had no activity for 180 days.

If this is still important to you, we ask that you leave a comment below. Your comment can be as simple as "still important to me". This lets people see that at least one person still cares about this. Someone will have to do this at most twice a year if there is no other activity.

Here are suggestions that might help resolve this more quickly:

1. Search for maintainers and people that previously touched the related code and @ mention them in a comment.
2. Ask on the NixOS Discourse.
3. Ask on the #nixos channel on irc.freenode.net.

[aanderse]

I would say this issue is still relevant... to the point where if it isn't fixed we should consider removing tt-rss and letting the user manually install it themselves.

[ajs124]

Before you remove it, we have a ttrss module that does this.
It seems largely incompatible with what's currently in nixpkgs though and I don't know if @dasJ or I will have time to upstream it any time soon.

[aanderse]

@ajs124 @dasJ I look forward to seeing it whenever that may be 😄

[dasJ]

@aanderse If you want to have a look, I posted it here: https://gist.github.com/dasJ/2c19e7dbde17daef11afd1ba0703c4a1

This used to be the upstream module, but I modified so heavily I couldn't just open a simple PR :/
Changes:

• Almost entirely served from the store (except locks, cache, and feed-icons which are writable)
• Dropped support for stuff I don't need like PostgreSQL and passwords stored in nix
• A lot less options where I don't see any point in changing them
• AppArmor support (just drop everything related to it, it uses our non-upstream AA module)
• Proper systemd sandboxing (rougly nixos/systemd-sandbox: A generic sandboxing module #87661)
• Uses our own MariaDB module

[stale]

I marked this as stale due to inactivity. → More info

[symphorien]

Implemented in #133133