1 files changed, 27 insertions, 16 deletions
diff --git a/configuration.nix b/configuration.nix
index 2784c41..fe96a43 100644
--- a/configuration.nix
+++ b/configuration.nix
@@ -12,42 +12,53 @@ in {
   networking.nat.externalInterface = "eth0";
 
   containers.ann = {
-    # Drop privileges
-    extraFlags = [ "-U" ];
     autoStart = true;
     hostAddress = "192.168.100.2";
     localAddress = "192.168.100.11";
     privateNetwork = true;
 
+    ephemeral = true;
+
+    bindMounts = {
+      "/srv/ann" = {
+        hostPath = "/mnt/ann/";
+        isReadOnly = false;
+      };
+    };
+
     config = { config, pkgs, ... }: {
+     systemd.tmpfiles.rules = [ "d /srv/ann 700 ann ann -" ];
+      users.users.ann = {
+        isSystemUser = true;
+        home = "/srv/ann";
+        group =  "ann";
+        extraGroups = [ "wheel" ];
+      };
+      users.groups.ann = {};
+     
+
       systemd.services.ann = {
           enable = true;
           description = "Ann";
+          environment = {
+            ANN_DB_URL = "sqlite3:/srv/ann/ann.db";
+            ANN_INTERFACE = "0.0.0.0";
+          };
           script = ''
-      export POSTGRESQL_URL="postgres://postgres@localhost:5432/ann?sslmode=disable" 
-      export ANN_INTERFACE="0.0.0.0"
+            echo "Running migrations"
             ${inputs.ann.apps.${pkgs.system}."migrate-up".program} 
+            echo "Migrations complete, starting server"
             exec ${inputs.ann.apps.${pkgs.system}.ann.default.program}
              '';
           serviceConfig = {
             Restart = "on-failure";
             RestartSec = 1;
+            User = "ann";
+            group = "ann";
           };
           wantedBy = [ "multi-user.target" ];
       };
       networking.firewall.allowedTCPPorts = [ 80 443 8080];
-      services.postgresql = {
-        enable = true;
-        ensureDatabases = [ "ann" ];
-        settings = {
-          listen_addresses = pkgs.lib.mkForce "*";
-        };
-        authentication = pkgs.lib.mkOverride 10 ''
-          #type database  DBuser                        auth-method
-          local all       all     trust
-          host    all             all             ::1/128                 trust
-        '';
-      };
       system.stateVersion = "24.05";
     };
   };