1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26

[Unit]
Description=blocks block-based authoring for blog posts
After=network.target

[Service]
Type=simple
# blocks has NO authentication and no CSRF protection: whoever can reach this
# address can create, edit and delete posts, and upload arbitrary files into
# the database. That is a deliberate trade for a single-user tool on your own
# machine — bind to loopback only, never 0.0.0.0.
#
# The binary comes from the nix profile, so what runs is always a build of
# committed sources:
#   nix profile upgrade blocks && systemctl --user restart blocks
#
# The wrapper puts cwebp (libwebp) on PATH; every uploaded image is re-encoded
# to WebP through it, so the service will fail uploads if started from an
# unwrapped binary.
ExecStart=%h/.nix-profile/bin/blocks serve \
  --db=%h/.local/share/blocks/blocks.sqlite \
  --addr=127.0.0.1:8791
Restart=on-failure
RestartSec=5

[Install]
WantedBy=default.target