feat: update systemd service definition

as per commit supabase/postgres@493bd39

(HEAD -> develop, origin/develop, origin/HEAD)
Author: Chris Stockton <[email protected]>
Date:   Wed Sep 17 07:48:52 2025 -0700

    feat: tighten gotrue.service deps and startup behavior (#1783)

Author: yvan-sraka

nix/modules/nixos/auth.nix

@@ -28,6 +28,23 @@ let
     GOTRUE_JWT_EXP = "3600";
     GOTRUE_JWT_SECRET = "your-super-secret-jwt-token-with-at-least-32-characters-long";
     GOTRUE_MAILER_AUTOCONFIRM = "true";
+
+    # Both v2 & v3 support reloading via signals, on linux this is SIGUSR1.
+    GOTRUE_RELOADING_SIGNAL_ENABLED = "true";
+    GOTRUE_RELOADING_SIGNAL_NUMBER = "10";
+
+    # Both v2 & v3 disable the poller. While gotrue sets it to off by default we
+    # defensively set it to false here.
+    GOTRUE_RELOADING_POLLER_ENABLED = "false";
+
+    # Determines how much idle time must pass before triggering a reload. This
+    # ensures only 1 reload operation occurs during a burst of config updates.
+    GOTRUE_RELOADING_GRACE_PERIOD_INTERVAL = "2s";
+
+    # v3 does not use filesystem notifications for config reloads.
+    GOTRUE_RELOADING_NOTIFY_ENABLED = "false";
+
+    # TODO: remove duplicates?
     GOTRUE_SITE_URL = "http://localhost:3000";
     GOTRUE_SMTP_ADMIN_EMAIL = "[email protected]";
     GOTRUE_SMTP_HOST = "localhost";
@@ -90,9 +107,10 @@ in
       description = "gotrue (auth)";
       wantedBy = [ "multi-user.target" ];
       serviceConfig = {
-        Type = "simple";
+        Type = "exec";
         WorkingDirectory = "/opt/gotrue";
         ExecStart = "${cfg.package}/bin/gotrue --config-dir /etc/auth.d";
+        ExecReload = "${pkgs.coreutils}/bin/kill -10 $MAINPID";
         User = "gotrue";
         Restart = "always";
         RestartSec = 3;
@@ -108,6 +126,10 @@ in
         #   pg_isready -h ${config.auth.settings.DB_HOST} -p ${config.auth.settings.DB_PORT} -U ${config.auth.settings.DB_USER}; do sleep 1; done
         # '';
       };
+      unitConfig = {
+        StartLimitIntervalSec = 10;
+        StartLimitBurst = 5;
+      };
     };
 
     systemd.tmpfiles.rules = [

nix/package.nix

@@ -2,7 +2,7 @@
 pkgs.buildGoModule {
   pname = "supabase-auth";
   version = "2.180.0";
-  src = ./..;
+  src = ./..; # TODO: better filters out what's not go files
 
   vendorHash = "sha256-knYvNkEVffWisvb4Dhm5qqtqQ4co9MGoNt6yH6dUll8=";