miniflux: add service

[bricewge]

Motivation for this change

This is an update for the PR #52638 written by @nornagon to add a service for miniflux. It amend the initial PR with the remarks made by @infinisil and two config options to specify the initial admin account.

Things done

• Tested using sandboxing (nix.useSandbox on NixOS, or option sandbox in nix.conf on non-NixOS)
• Built on platform(s)
  • NixOS
  • macOS
  • other Linux distributions
• Tested via one or more NixOS test(s) if existing and applicable for the change (look inside nixos/tests)
• Tested compilation of all pkgs that depend on this change using nix-shell -p nox --run "nox-review wip"
• Tested execution of all binary files (usually in ./result/bin/)
• Determined the impact on package closure size (by running nix path-info -S before and after)
• Assured whether relevant documentation is up to date
• Fits CONTRIBUTING.md.

---

[bricewge]

Can I get a new review since I think I addressed all the comments?

[andir]

Overall this looks very good.

Could we get a NixOS VM test as well? :-)

[bricewge]

I have added the VM test.

However it currently fail from what I think is a bug in systemd; for the test to be working you need to comment out DynamicUser = true;.

Let's follow the manual crumbs:

If DynamicUser= is enabled, RemoveIPC=, PrivateTmp= are implied.
---systemd.exec(5)

So with DynamicUser= enabled we also have PrivateTmp=.

If the executable path is prefixed with "+" then the process is executed with
full privileges. In this mode privilege restrictions configured with User=,
Group=, CapabilityBoundingSet= or the various file system namespacing options
(such as PrivateDevices=, PrivateTmp=) are not applied to the invoked command
line (but still affect any other ExecStart=, ExecStop=, … lines).
---systemd.service(5)

But since we prefixed the path for ExecStartPre= the pre-start script should not be affected by PrivateTmp=, unfortunately it looks like it's not the case. Here is the log of the failing test and here the log of the not failing one (without DynamicUser=).

Do you think it is a systemd bug? Could this PR be merged by using a specific user/group?

[flokli]

@bricewge would #57677 help (as you don't need to access postgresql through the socket in /tmp), or declaring databases and users through what's suggested in #56720 ?

[bricewge]

@flokli Rebasing on master seems to have fixed it, so maybe #57677 helped.
The test pass on my machine.

[bricewge]

I have updated the PR to stay more in line with NixOS/rfcs#42, options have been removed and you can now fully configure miniflux.

Note that the default credentials will be in the store, it doesn't looks like a great deal since it is public knowledge.

[flokli]

LGTM. @andir ?

[joachifm]

@GrahamcOfBorg test miniflux

[nornagon]

Thanks for pushing this through to completion @bricewge!