From e954aba66fc9f038db2e4770a9507ff3f3102e97 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Sandro=20J=C3=A4ckel?= <sandro.jaeckel@gmail.com>
Date: Thu, 11 Dec 2025 00:03:53 +0100
Subject: [PATCH 1/2] nixos/gitea: sort things more natural

(cherry picked from commit f089a37e2c5cab7fcb9997c985eb815ea31782f6)
---
 nixos/modules/services/misc/gitea.nix | 7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)

diff --git a/nixos/modules/services/misc/gitea.nix b/nixos/modules/services/misc/gitea.nix
index 668f68b4b66f..70a762368b38 100644
--- a/nixos/modules/services/misc/gitea.nix
+++ b/nixos/modules/services/misc/gitea.nix
@@ -913,11 +913,10 @@ in
         ]
         ++ lib.optional (useSendmail && config.services.postfix.enable) "/var/lib/postfix/queue/maildrop";
         UMask = "0027";
-        # Capabilities
-        CapabilityBoundingSet = "";
-        # Security
-        NoNewPrivileges = !useSendmail;
+
         # Sandboxing
+        CapabilityBoundingSet = "";
+        NoNewPrivileges = !useSendmail;
         ProtectSystem = "strict";
         ProtectHome = true;
         PrivateTmp = true;

From 81f612b14ce89c39fa43c90eb3f59afc46e2a596 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Sandro=20J=C3=A4ckel?= <sandro.jaeckel@gmail.com>
Date: Thu, 11 Dec 2025 00:04:01 +0100
Subject: [PATCH 2/2] nixos/gitea: increase start up time out

For migrations on not even a medium sized instances, the default 90s are
not enough.

(cherry picked from commit 602831a1419f608cd58cc25119a25ae40f743b68)
---
 nixos/modules/services/misc/gitea.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/nixos/modules/services/misc/gitea.nix b/nixos/modules/services/misc/gitea.nix
index 70a762368b38..80f70173bb35 100644
--- a/nixos/modules/services/misc/gitea.nix
+++ b/nixos/modules/services/misc/gitea.nix
@@ -913,6 +913,8 @@ in
         ]
         ++ lib.optional (useSendmail && config.services.postfix.enable) "/var/lib/postfix/queue/maildrop";
         UMask = "0027";
+        # one mid size deployments, Gitea already gets killed when doing DB migrations
+        TimeoutStartSec = "3m";
 
         # Sandboxing
         CapabilityBoundingSet = "";