From 3ab85ed1aca250501bcd098f5c304e3ddde96e79 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Vladim=C3=ADr=20=C4=8Cun=C3=A1t?= Date: Tue, 9 Jan 2018 17:13:39 +0100 Subject: [PATCH] nixos/kresd: use DNSSEC root trust anchor from nixpkgs in read-only way. If the cache directory is empty and you use the very same service for system's DNS, kresd is unable to bootstrap root trust anchors, as it would need a DNS lookup. Also, if we don't rely on bootstrap, the extra lua deps of kresd could be dropped by default, but let's not do that now, as the difference in closure size is only ~4 MB, and there may be other use cases than running the package as nixos service this way. --- nixos/modules/services/networking/kresd.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/nixos/modules/services/networking/kresd.nix b/nixos/modules/services/networking/kresd.nix index 64f36cadc1d..7e36c69cc4e 100644 --- a/nixos/modules/services/networking/kresd.nix +++ b/nixos/modules/services/networking/kresd.nix @@ -99,7 +99,7 @@ in script = '' exec '${package}/bin/kresd' --config '${configFile}' \ - -k '${cfg.cacheDir}/root.key' + -k '${pkgs.dns-root-data}/root.key' ''; requires = [ "kresd.socket" ];