Can I get a new review since I think I addressed all the comments?

Overall this looks very good.

Could we get a NixOS VM test as well? :-)

I have added the VM test.

However it currently fail from what I think is a bug in systemd; for the test to be working you need to comment out DynamicUser = true;.

Let's follow the manual crumbs:

If DynamicUser= is enabled, RemoveIPC=, PrivateTmp= are implied.
---systemd.exec(5)

So with DynamicUser= enabled we also have PrivateTmp=.

If the executable path is prefixed with "+" then the process is executed with
full privileges. In this mode privilege restrictions configured with User=,
Group=, CapabilityBoundingSet= or the various file system namespacing options
(such as PrivateDevices=, PrivateTmp=) are not applied to the invoked command
line (but still affect any other ExecStart=, ExecStop=, … lines).
---systemd.service(5)

But since we prefixed the path for ExecStartPre= the pre-start script should not be affected by PrivateTmp=, unfortunately it looks like it's not the case. Here is the log of the failing test and here the log of the not failing one (without DynamicUser=).

Do you think it is a systemd bug? Could this PR be merged by using a specific user/group?

@bricewge would #57677 help (as you don't need to access postgresql through the socket in /tmp), or declaring databases and users through what's suggested in #56720 ?

@flokli Rebasing on master seems to have fixed it, so maybe #57677 helped.
The test pass on my machine.

I have updated the PR to stay more in line with NixOS/rfcs#42, options have been removed and you can now fully configure miniflux.

Note that the default credentials will be in the store, it doesn't looks like a great deal since it is public knowledge.

@GrahamcOfBorg test miniflux

Thanks for pushing this through to completion @bricewge!