From 5c355dedbf8e162ec35e08dcc571b941ca774834 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Fri, 12 Jun 2026 22:56:50 +0200
Subject: [PATCH] nixos/netbox: merge bind options into one

They are all passed to gunicorn's --bind flag, so let the user pass
whatever they want.
---
 nixos/modules/services/web-apps/netbox.nix | 56 ++++++++++------------
 nixos/tests/web-apps/netbox-upgrade.nix    |  2 +-
 nixos/tests/web-apps/netbox/default.nix    |  2 +-
 nixos/tests/web-apps/netbox/testScript.py  |  2 +-
 4 files changed, 27 insertions(+), 35 deletions(-)

diff --git a/nixos/modules/services/web-apps/netbox.nix b/nixos/modules/services/web-apps/netbox.nix
index 148a2e3ac3d5..e9956b3e927d 100644
--- a/nixos/modules/services/web-apps/netbox.nix
+++ b/nixos/modules/services/web-apps/netbox.nix
@@ -10,6 +10,7 @@ let
     any
     attrValues
     mkChangedOptionModule
+    mkOption
     mkRemovedOptionModule
     optionalString
     ;
@@ -86,10 +87,18 @@ in
         "1" = config.services.netbox.apiTokenPeppersFile;
       })
     )
-    (mkRemovedOptionModule
-      [ "services" "netbox" "keycloakClientSecret" ] ''
-        Too much granularity hurts maintainability. Please configure secret key loading via `services.netbox.extraConfig` instead.
-      '')
+    (mkRemovedOptionModule [ "services" "netbox" "listenAddress" ] ''
+      Use `services.netbox.bind` with <ip>:<port> format instead.
+    '')
+    (mkRemovedOptionModule [ "services" "netbox" "port" ] ''
+      Use `services.netbox.bind` with <ip>:<port> format instead.
+    '')
+    (mkRemovedOptionModule [ "services" "netbox" "unixSocket" ] ''
+      Use `services.netbox.bind` with unix:<path> format instead.
+    '')
+    (mkRemovedOptionModule [ "services" "netbox" "keycloakClientSecret" ] ''
+      Too much granularity hurts maintainability. Please configure secret key loading via `services.netbox.extraConfig` instead.
+    '')
   ];
 
   options.services.netbox = {
@@ -128,23 +137,19 @@ in
       };
     };
 
-    listenAddress = lib.mkOption {
+    bind = lib.mkOption {
       type = lib.types.str;
-      default = "[::1]";
+      default = "unix:/run/netbox/netbox.sock";
+      example = "[::1]:8001";
       description = ''
-        Address the server will listen on.
-        Ignored if `unixSocket` is set.
-      '';
-    };
+        IP and port or Unix domain socket path to bind the HTTP socket to.
 
-    unixSocket = lib.mkOption {
-      type = lib.types.nullOr lib.types.str;
-      default = null;
-      description = ''
-        Enable Unix Socket for the server to listen on.
-        `listenAddress` and `port` will be ignored.
+        ::: {.tip}
+        This setting will be passed to gunicorn's [--bind] flag.
+        :::
+
+        [--bind]: https://gunicorn.org/reference/settings/#bind
       '';
-      example = "/run/netbox/netbox.sock";
     };
 
     gunicornArgs = lib.mkOption {
@@ -171,15 +176,6 @@ in
       '';
     };
 
-    port = lib.mkOption {
-      type = lib.types.port;
-      default = 8001;
-      description = ''
-        Port the server will listen on.
-        Ignored if `unixSocket` is set.
-      '';
-    };
-
     plugins = lib.mkOption {
       type = with lib.types; functionTo (listOf package);
       default = _: [ ];
@@ -457,16 +453,12 @@ in
           serviceConfig = defaultServiceConfig // {
             ExecStart = ''
               ${pkg.gunicorn}/bin/gunicorn netbox.wsgi \
-                --bind ${
-                  if (cfg.unixSocket != null) then
-                    "unix:${cfg.unixSocket}"
-                  else
-                    "${cfg.listenAddress}:${toString cfg.port}"
-                } \
+                --bind ${cfg.bind} \
                 --pythonpath ${pkg}/opt/netbox/netbox \
                 ${lib.concatStringsSep " " cfg.gunicornArgs}
             '';
             PrivateTmp = true;
+            RuntimeDirectory = "netbox";
             TimeoutStartSec = lib.mkDefault "10min";
           };
         };
diff --git a/nixos/tests/web-apps/netbox-upgrade.nix b/nixos/tests/web-apps/netbox-upgrade.nix
index 389f60856c68..b8e23c6cf8de 100644
--- a/nixos/tests/web-apps/netbox-upgrade.nix
+++ b/nixos/tests/web-apps/netbox-upgrade.nix
@@ -43,7 +43,7 @@ in
 
         virtualHosts.netbox = {
           default = true;
-          locations."/".proxyPass = "http://localhost:${toString config.services.netbox.port}";
+          locations."/".proxyPass = "http://${config.services.netbox.bind}";
           locations."/static/".alias = "/var/lib/netbox/static/";
         };
       };
diff --git a/nixos/tests/web-apps/netbox/default.nix b/nixos/tests/web-apps/netbox/default.nix
index da9d2c9bfe0f..6c1a48b30d94 100644
--- a/nixos/tests/web-apps/netbox/default.nix
+++ b/nixos/tests/web-apps/netbox/default.nix
@@ -70,7 +70,7 @@ import ../../make-test-python.nix (
 
           virtualHosts.netbox = {
             default = true;
-            locations."/".proxyPass = "http://localhost:${toString config.services.netbox.port}";
+            locations."/".proxyPass = "http://${toString config.services.netbox.bind}";
             locations."/static/".alias = "/var/lib/netbox/static/";
           };
         };
diff --git a/nixos/tests/web-apps/netbox/testScript.py b/nixos/tests/web-apps/netbox/testScript.py
index 4ff035a1f0cf..8532a4538ff9 100644
--- a/nixos/tests/web-apps/netbox/testScript.py
+++ b/nixos/tests/web-apps/netbox/testScript.py
@@ -62,7 +62,7 @@ def compare(a: str, b: str):
 
 with subtest("Home screen loads"):
     machine.wait_until_succeeds(
-        "curl -sSfL http://[::1]:8001 | grep '<title>Home | NetBox</title>'"
+        "curl -sSfL http://[::1]:80 | grep '<title>Home | NetBox</title>'"
     )
 
 with subtest("Staticfiles are generated"):