public/nixpkgs
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

nixos/acme: Incorporate review suggestions

Browse Source
This commit is contained in:
Lucas Savva 2021-01-09 19:15:03 +00:00
parent 92a3a37153
commit a01df7dc46
1 changed files with 11 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
nixos/modules/security/acme.nix
View File

@ -63,15 +63,16 @@ let
# exist and have the correct user and group, since group # exist and have the correct user and group, since group
# is configurable on a per-cert basis. # is configurable on a per-cert basis.
userMigrationService = let userMigrationService = let
script = with builtins; concatStringsSep "\n" (mapAttrsToList (cert: data: '' script = with builtins; ''
chown -R acme .lego/accounts chown -R acme .lego/accounts
'' + (concatStringsSep "\n" (mapAttrsToList (cert: data: ''
for fixpath in ${escapeShellArg cert} .lego/${escapeShellArg cert}; do for fixpath in ${escapeShellArg cert} .lego/${escapeShellArg cert}; do
if [ -d "$fixpath" ]; then if [ -d "$fixpath" ]; then
chmod -R u=rwX,g=rX,o= "$fixpath" chmod -R u=rwX,g=rX,o= "$fixpath"
chown -R acme:${data.group} "$fixpath" chown -R acme:${data.group} "$fixpath"
fi fi
done done
'') certConfigs); '') certConfigs));
in { in {
description = "Fix owner and group of all ACME certificates"; description = "Fix owner and group of all ACME certificates";
@ -704,6 +705,14 @@ in {
}) certConfigs; }) certConfigs;
# Create targets to limit the number of simultaneous account creations # Create targets to limit the number of simultaneous account creations
# How it works:
# - Pick a "leader" cert service, which will be in charge of creating the account,
# and run first (requires + after)
# - Make all other cert services sharing the same account wait for the leader to
# finish before starting (requiredBy + before).
# Using a target here is fine - account creation is a one time event. Even if
# systemd clean --what=state is used to delete the account, so long as the user
# then runs one of the cert services, there won't be any issues.
accountTargets = mapAttrs' (hash: confs: let accountTargets = mapAttrs' (hash: confs: let
leader = "acme-${(builtins.head confs).cert}.service"; leader = "acme-${(builtins.head confs).cert}.service";
dependantServices = map (conf: "acme-${conf.cert}.service") (builtins.tail confs); dependantServices = map (conf: "acme-${conf.cert}.service") (builtins.tail confs);