From 12dd309b8e334eaf19eae6d9eb9bb85024457b8a Mon Sep 17 00:00:00 2001
From: Ben Sima <ben@bensima.com>
Date: Thu, 21 May 2026 13:09:59 -0400
Subject: Convert to nix flake; fix systemd service to use nix run

- Add flake.nix with nixos-unstable nixpkgs, devShell and slopbot package
- Add flake.lock
- Update .envrc to 'use flake .'
- Update slopbot.service: use 'nix run' instead of nix-shell, remove
  broken sandbox options (ProtectHome, InaccessiblePaths, ProtectSystem,
  ReadOnlyPaths, ReadWritePaths, PrivateTmp) that block nix store access
- Delete shell.nix
- Add 'result' to .gitignore
- Restore openai to requirements.txt (was accidentally dropped)
---
 slopbot.service | 29 +++++++++++++++++++++++++++++
 1 file changed, 29 insertions(+)
 create mode 100644 slopbot.service

(limited to 'slopbot.service')

diff --git a/slopbot.service b/slopbot.service
new file mode 100644
index 0000000..396e9d0
--- /dev/null
+++ b/slopbot.service
@@ -0,0 +1,29 @@
+[Unit]
+Description=slopbot Zulip bot
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=simple
+WorkingDirectory=/home/ben/src/bsima/slopbot
+EnvironmentFile=-/home/ben/src/bsima/slopbot/.env
+ExecStart=/run/current-system/sw/bin/nix --extra-experimental-features 'nix-command flakes' run /home/ben/src/bsima/slopbot#slopbot
+Restart=on-failure
+RestartSec=5
+
+NoNewPrivileges=true
+CapabilityBoundingSet=
+LockPersonality=true
+PrivateDevices=true
+ProtectClock=true
+ProtectControlGroups=true
+ProtectKernelLogs=true
+ProtectKernelModules=true
+ProtectKernelTunables=true
+RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
+RestrictNamespaces=true
+RestrictRealtime=true
+SystemCallArchitectures=native
+
+[Install]
+WantedBy=multi-user.target
-- 
cgit v1.2.3