diff options
| author | Artturin <Artturin@artturin.com> | 2021-12-01 23:19:58 +0200 |
|---|---|---|
| committer | Artturin <Artturin@artturin.com> | 2021-12-02 17:45:50 +0200 |
| commit | 2fb77151e8fb0c47509fc879e3df553fba7254b4 (patch) | |
| tree | d5bfde6d6248afa2244647b1dc20aebbbbf2e920 | |
| parent | a78dd785b29bbbcad5490282308b9dbdc244a0f3 (diff) | |
| download | nixpkgs-2fb77151e8fb0c47509fc879e3df553fba7254b4.tar nixpkgs-2fb77151e8fb0c47509fc879e3df553fba7254b4.tar.gz nixpkgs-2fb77151e8fb0c47509fc879e3df553fba7254b4.tar.bz2 nixpkgs-2fb77151e8fb0c47509fc879e3df553fba7254b4.tar.lz nixpkgs-2fb77151e8fb0c47509fc879e3df553fba7254b4.tar.xz nixpkgs-2fb77151e8fb0c47509fc879e3df553fba7254b4.tar.zst nixpkgs-2fb77151e8fb0c47509fc879e3df553fba7254b4.zip | |
nix-serve: fix NIX_SECRET_KEY_FILE
| -rw-r--r-- | nixos/modules/services/networking/nix-serve.nix | 14 |
1 files changed, 9 insertions, 5 deletions
diff --git a/nixos/modules/services/networking/nix-serve.nix b/nixos/modules/services/networking/nix-serve.nix index 7fc145f2303..390f0ddaee8 100644 --- a/nixos/modules/services/networking/nix-serve.nix +++ b/nixos/modules/services/networking/nix-serve.nix @@ -37,8 +37,6 @@ in nix-store --generate-binary-cache-key key-name secret-key-file public-key-file ``` - Make sure user `nix-serve` has read access to the private key file. - For more details see <citerefentry><refentrytitle>nix-store</refentrytitle><manvolnum>1</manvolnum></citerefentry>. ''; }; @@ -61,16 +59,22 @@ in path = [ config.nix.package.out pkgs.bzip2.bin ]; environment.NIX_REMOTE = "daemon"; - environment.NIX_SECRET_KEY_FILE = cfg.secretKeyFile; + + script = '' + ${lib.optionalString (cfg.secretKeyFile != null) '' + export NIX_SECRET_KEY_FILE="$CREDENTIALS_DIRECTORY/NIX_SECRET_KEY_FILE" + ''} + exec ${pkgs.nix-serve}/bin/nix-serve --listen ${cfg.bindAddress}:${toString cfg.port} ${cfg.extraParams} + ''; serviceConfig = { Restart = "always"; RestartSec = "5s"; - ExecStart = "${pkgs.nix-serve}/bin/nix-serve " + - "--listen ${cfg.bindAddress}:${toString cfg.port} ${cfg.extraParams}"; User = "nix-serve"; Group = "nix-serve"; DynamicUser = true; + LoadCredential = lib.optionalString (cfg.secretKeyFile != null) + "NIX_SECRET_KEY_FILE:${cfg.secretKeyFile}"; }; }; }; |