From 8920474c9e3a765b7ffebc842881f7d392f45c71 Mon Sep 17 00:00:00 2001
From: Minijackson <minijackson@riseup.net>
Date: Thu, 13 Aug 2026 17:16:42 +0200
Subject: [PATCH 1/2] nixos/miniflux: fix AppArmor profile

(cherry picked from commit 72f451bd01d7804715ee124152ac7e9bfb174b7e)
---
 nixos/modules/services/web-apps/miniflux.nix | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/nixos/modules/services/web-apps/miniflux.nix b/nixos/modules/services/web-apps/miniflux.nix
index 2130427813f5..412426a217f0 100644
--- a/nixos/modules/services/web-apps/miniflux.nix
+++ b/nixos/modules/services/web-apps/miniflux.nix
@@ -214,7 +214,13 @@ in
       abi <abi/4.0>,
       include <tunables/global>
 
-      profile ${cfg.package}/bin/miniflux {
+      # Flag `attach_disconnected` is necessary
+      # because the PostgreSQL socket path appears
+      # as a "disconnected" path: `run/postgresql/.s.PGSQL.XXXX`,
+      # without the trailing slash, which AppArmor can't resolve.
+      # The flag prepends a `/`, which isn't recommended,
+      # but there aren't any alternative currently.
+      profile ${cfg.package}/bin/miniflux flags=(attach_disconnected) {
         include <abstractions/base>
         include <abstractions/nameservice>
         include <abstractions/ssl_certs>
@@ -222,6 +228,8 @@ in
         include "${pkgs.apparmorRulesFromClosure { name = "miniflux"; } cfg.package}"
         ${cfg.package}/bin/miniflux r,
         /run/miniflux/** rw,
+        /run/postgresql/.s.PGSQL.* rw,
+        /run/credentials/** r,
         include if exists <local/bin.miniflux>
       }
     '';

From 7c3b7ae19c2d1af381c73dde766367aa8632aac5 Mon Sep 17 00:00:00 2001
From: Minijackson <minijackson@riseup.net>
Date: Thu, 13 Aug 2026 17:18:32 +0200
Subject: [PATCH 2/2] nixosTests.miniflux: Revert "remove apparmor"

This reverts commit 533498ea0a3814ad7efbf1f5a1f299a33866faaa.

(cherry picked from commit 266cedd5f19392886e533966d885f84144157b6e)
---
 nixos/tests/miniflux.nix | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/nixos/tests/miniflux.nix b/nixos/tests/miniflux.nix
index 3bdf4480e7e2..549dd4966439 100644
--- a/nixos/tests/miniflux.nix
+++ b/nixos/tests/miniflux.nix
@@ -29,6 +29,7 @@ in
     default =
       { ... }:
       {
+        security.apparmor.enable = true;
         services.miniflux = {
           enable = true;
           inherit adminCredentialsFile;
@@ -38,6 +39,7 @@ in
     withoutSudo =
       { ... }:
       {
+        security.apparmor.enable = true;
         services.miniflux = {
           enable = true;
           inherit adminCredentialsFile;
@@ -48,6 +50,7 @@ in
     customized =
       { ... }:
       {
+        security.apparmor.enable = true;
         services.miniflux = {
           enable = true;
           config = {
@@ -82,6 +85,7 @@ in
     externalDb =
       { ... }:
       {
+        security.apparmor.enable = true;
         services.miniflux = {
           enable = true;
           createDatabaseLocally = false;
@@ -105,6 +109,7 @@ in
       machine.succeed(
           f"curl 'http://localhost:{port}/v1/me' -u '{user}' -H Content-Type:application/json | grep '\"is_admin\":true'"
       )
+      machine.fail('journalctl -b --no-pager --grep "^audit: .*apparmor=\\"DENIED\\""')
 
     default.start()
     withoutSudo.start()