From a142420c52fe2b23d81af7f9f39385e3e5f8c5db Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Tim=20H=C3=A4ring?= <tim.haering@gmail.com>
Date: Fri, 20 Feb 2026 10:08:04 +0100
Subject: [PATCH] nixos/blocky: allow socket db connection

I am currently working around that with
```
settings.queryLog.target = "postgresql://blocky@127.0.0.1/blocky?sslmode=disable";
```
but it would be nice to use a socket connection instead
---
 nixos/modules/services/networking/blocky.nix | 17 +++++++++++++----
 1 file changed, 13 insertions(+), 4 deletions(-)

diff --git a/nixos/modules/services/networking/blocky.nix b/nixos/modules/services/networking/blocky.nix
index 2cd6b28e1293..5bbc17139641 100644
--- a/nixos/modules/services/networking/blocky.nix
+++ b/nixos/modules/services/networking/blocky.nix
@@ -64,10 +64,19 @@ in
         ProtectKernelTunables = true;
         ProtectSystem = "strict";
         Restart = "on-failure";
-        RestrictAddressFamilies = [
-          "AF_INET"
-          "AF_INET6"
-        ];
+        RestrictAddressFamilies =
+          let
+            logType = lib.attrByPath [ "settings" "queryLog" "type" ] "" cfg;
+          in
+          (lib.optional (lib.elem logType [
+            "mysql"
+            "postgresql"
+            "timescale"
+          ]) "AF_UNIX")
+          ++ [
+            "AF_INET"
+            "AF_INET6"
+          ];
         RestrictNamespaces = true;
         RestrictRealtime = true;
         RuntimeDirectory = "blocky";