diff options
| author | guangtao <gtrunsec@hardenedlinux.org> | 2023-01-21 06:09:22 -0800 |
|---|---|---|
| committer | guangtao <gtrunsec@hardenedlinux.org> | 2023-01-21 06:09:22 -0800 |
| commit | 6c46078aadb97028534ce53db10667a5388c98cf (patch) | |
| tree | 1e412aa7d92b9befef8fed00dc4bb8638c523328 | |
| parent | 3836bf029740fa130b1565aa073afe938eac0171 (diff) | |
| download | nixpkgs-6c46078aadb97028534ce53db10667a5388c98cf.tar nixpkgs-6c46078aadb97028534ce53db10667a5388c98cf.tar.gz nixpkgs-6c46078aadb97028534ce53db10667a5388c98cf.tar.bz2 nixpkgs-6c46078aadb97028534ce53db10667a5388c98cf.tar.lz nixpkgs-6c46078aadb97028534ce53db10667a5388c98cf.tar.xz nixpkgs-6c46078aadb97028534ce53db10667a5388c98cf.tar.zst nixpkgs-6c46078aadb97028534ce53db10667a5388c98cf.zip | |
nixos/nomad: add LoadCredential option
| -rw-r--r-- | nixos/modules/services/networking/nomad.nix | 15 |
1 files changed, 14 insertions, 1 deletions
diff --git a/nixos/modules/services/networking/nomad.nix b/nixos/modules/services/networking/nomad.nix index c6f0624c8ce..b1e51195247 100644 --- a/nixos/modules/services/networking/nomad.nix +++ b/nixos/modules/services/networking/nomad.nix @@ -71,6 +71,17 @@ in ''; }; + credentials = mkOption { + description = lib.mdDoc '' + Credentials envs used to configure nomad secrets. + ''; + type = types.attrsOf types.str; + default = { }; + + example = { + logs_remote_write_password = "/run/keys/nomad_write_password"; + }; + }; settings = mkOption { type = format.type; @@ -148,7 +159,8 @@ in }; in "${cfg.package}/bin/nomad agent -config=/etc/nomad.json -plugin-dir=${pluginsDir}/bin" + - concatMapStrings (path: " -config=${path}") cfg.extraSettingsPaths; + concatMapStrings (path: " -config=${path}") cfg.extraSettingsPaths + + concatMapStrings (key: " -config=\${CREDENTIALS_DIRECTORY}/${key}") (lib.attrNames cfg.credentials); KillMode = "process"; KillSignal = "SIGINT"; LimitNOFILE = 65536; @@ -157,6 +169,7 @@ in Restart = "on-failure"; RestartSec = 2; TasksMax = "infinity"; + LoadCredential = lib.mapAttrsToList (key: value: "${key}:${value}") cfg.credentials; } (mkIf cfg.enableDocker { SupplementaryGroups = "docker"; # space-separated string |