NixOS 服务管理实战：systemd 声明、NixOS 容器与常用服务部署

systemd.services.myapp = {
  description = "My application";
  wantedBy = [ "multi-user.target" ];   # 开机自启
  serviceConfig = {
    ExecStart = "${pkgs.myapp}/bin/myapp --config /etc/myapp.conf";
    Restart = "on-failure";
    User = "myapp";
  };
};

{ pkgs, ... }:
{
  systemd.services.hello = {
    wantedBy = [ "multi-user.target" ];
    serviceConfig = {
      ExecStart = "${pkgs.hello}/bin/hello";
      Restart = "always";
    };
  };
}

systemd.services.backend = {
  after = [ "network-online.target" "database.service" ];  # 之后启动
  requires = [ "database.service" ];                        # 强依赖
  wantedBy = [ "multi-user.target" ];
  serviceConfig.ExecStart = "${pkgs.backend}/bin/backend";
};

systemd.services.myapp = {
  serviceConfig.Environment = [
    "PORT=8080"
    "LOG_LEVEL=info"
  ];
  # 或引用文件
  environmentFiles = [ /etc/myapp.env ];
};

users.users.myapp = {
  isSystemUser = true;
  group = "myapp";
};
users.groups.myapp = { };

systemd.services.myapp.serviceConfig.User = "myapp";

systemd.services.myapp = {
  environmentFiles = [ config.age.secrets.myapp_env.path ];   # 挂在 /run/secrets/
};

services.nginx = {
  enable = true;
  virtualHosts."example.com" = {
    root = "/var/www/example";
    enableACME = true;                 # Let's Encrypt 自动证书
    forceSSL = true;
  };
};

services.nginx.virtualHosts."api.example.com" = {
  locations."/" = {
    proxyPass = "http://127.0.0.1:8080";
    proxyWebsockets = true;
  };
};
networking.firewall.allowedTCPPorts = [ 80 443 ];

services.postgresql = {
  enable = true;
  package = pkgs.postgresql_16;
  initialDatabases = [{ name = "myapp"; }];
  authentication = ''
    local all all trust
    host all all 127.0.0.1/32 trust
  '';
  settings = { max_connections = 100; };
};

services.redis.servers = {
  default = {
    enable = true;
    port = 6379;
    bind = "127.0.0.1";
  };
};

containers.web = {
  privateNetwork = true;
  hostAddress = "10.233.0.1";
  localAddress = "10.233.0.2";
  config = { pkgs, ... }: {
    services.nginx.enable = true;
  };
};

nixos-container list        # 列出容器
nixos-container login web   # 进入容器

systemd.timers.backup = {
  wantedBy = [ "timers.target" ];
  timerConfig = {
    OnCalendar = "daily";        # 每天
    Persistent = true;           # 补跑错过的
  };
};
systemd.services.backup = {
  serviceConfig.ExecStart = "${pkgs.rsync}/bin/rsync -a /data /backup/";
};

services.cron = {
  enable = true;
  systemCronJobs = [ "0 3 * * * root /usr/bin/backup" ];
};

systemctl status myapp        # 状态
journalctl -u myapp -f        # 实时日志
systemctl list-units --failed # 失败单元