From 6d5a6cab711e8dfd4e6d5ff677f82690a9d9e07a Mon Sep 17 00:00:00 2001
From: e1mo <git@e1mo.de>
Date: Thu, 21 Mar 2024 15:41:00 +0100
Subject: [PATCH 1/2] nixos/pretix: Fix pdf generation

Previously, pdftk (part of the ticket, badge, ... generation pipeline)
would fail with:

```
Error occurred during initialization of VM
Failed to mark memory page as executable - check if grsecurity/PaX is enabled
```
Thise caused pdf generation to fail.

Since pdftk is a java application and, according to systemd.exec(5),

 > Note that [MemoryDenyWriteExecute=] is incompatible with programs and
 > libraries that generate program code dynamically at runtime, including
 > JIT execution engines, executable stacks, and code "trampoline" featu
 > re of various C compilers.

Disabling `MemoryDenyWriteExecute=` fixes it.
---
 nixos/modules/services/web-apps/pretix.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/nixos/modules/services/web-apps/pretix.nix b/nixos/modules/services/web-apps/pretix.nix
index 500b2eb5416b..18d4a20beeec 100644
--- a/nixos/modules/services/web-apps/pretix.nix
+++ b/nixos/modules/services/web-apps/pretix.nix
@@ -479,7 +479,7 @@ in
           CapabilityBoundingSet = [ "" ];
           DevicePolicy = "closed";
           LockPersonality = true;
-          MemoryDenyWriteExecute = true;
+          MemoryDenyWriteExecute = false; # required by pdftk
           NoNewPrivileges = true;
           PrivateDevices = true;
           PrivateTmp = true;

From bc25c4bd7d2d2b437a36e0f884787fd5e29245fd Mon Sep 17 00:00:00 2001
From: e1mo <git@e1mo.de>
Date: Thu, 21 Mar 2024 16:53:42 +0100
Subject: [PATCH 2/2] nixos/pretix: raise TimeoutStartSec

On some slower systems or ones with a slower database (connection) the
initial migrations can exceed the default 90s timeout.
---
 nixos/modules/services/web-apps/pretix.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/nixos/modules/services/web-apps/pretix.nix b/nixos/modules/services/web-apps/pretix.nix
index 18d4a20beeec..2355f8c450a1 100644
--- a/nixos/modules/services/web-apps/pretix.nix
+++ b/nixos/modules/services/web-apps/pretix.nix
@@ -535,6 +535,7 @@ in
           fi
         '';
         serviceConfig = {
+          TimeoutStartSec = "5min";
           ExecStart = "${getExe' pythonEnv "gunicorn"} --bind unix:/run/pretix/pretix.sock ${cfg.gunicorn.extraArgs} pretix.wsgi";
           RuntimeDirectory = "pretix";
         };