diff options
author | Pascal Bach <pascal.bach@nextrem.ch> | 2021-08-02 21:41:50 +0200 |
---|---|---|
committer | GitHub <noreply@github.com> | 2021-08-02 21:41:50 +0200 |
commit | ee50c21488d5cb3aed33035855d182e67bbda285 (patch) | |
tree | a7b97892176c3591e277a6bb9d4e4397d389d5df | |
parent | 0d0a612f404ec5ce1bb0bec081812417563fb4eb (diff) | |
parent | bdc96d33511d95a783ead5533b0d866b0a251aab (diff) | |
download | nixpkgs-ee50c21488d5cb3aed33035855d182e67bbda285.tar nixpkgs-ee50c21488d5cb3aed33035855d182e67bbda285.tar.gz nixpkgs-ee50c21488d5cb3aed33035855d182e67bbda285.tar.bz2 nixpkgs-ee50c21488d5cb3aed33035855d182e67bbda285.tar.lz nixpkgs-ee50c21488d5cb3aed33035855d182e67bbda285.tar.xz nixpkgs-ee50c21488d5cb3aed33035855d182e67bbda285.tar.zst nixpkgs-ee50c21488d5cb3aed33035855d182e67bbda285.zip |
Merge pull request #111768 from misuzu/gitlab-runner-warnings
nixos/gitlab-runner: warn about possible secrets leak
-rw-r--r-- | nixos/modules/services/continuous-integration/gitlab-runner.nix | 8 |
1 files changed, 7 insertions, 1 deletions
diff --git a/nixos/modules/services/continuous-integration/gitlab-runner.nix b/nixos/modules/services/continuous-integration/gitlab-runner.nix index 2c6d9530a6b..15c37c2bc76 100644 --- a/nixos/modules/services/continuous-integration/gitlab-runner.nix +++ b/nixos/modules/services/continuous-integration/gitlab-runner.nix @@ -339,6 +339,9 @@ in <literal>CI_SERVER_URL=<CI server URL></literal> <literal>REGISTRATION_TOKEN=<registration secret></literal> + + WARNING: make sure to use quoted absolute path, + or it is going to be copied to Nix Store. ''; }; registrationFlags = mkOption { @@ -523,7 +526,10 @@ in }; }; config = mkIf cfg.enable { - warnings = optional (cfg.configFile != null) "services.gitlab-runner.`configFile` is deprecated, please use services.gitlab-runner.`services`."; + warnings = (mapAttrsToList + (n: v: "services.gitlab-runner.services.${n}.`registrationConfigFile` points to a file in Nix Store. You should use quoted absolute path to prevent this.") + (filterAttrs (n: v: isStorePath v.registrationConfigFile) cfg.services)) + ++ optional (cfg.configFile != null) "services.gitlab-runner.`configFile` is deprecated, please use services.gitlab-runner.`services`."; environment.systemPackages = [ cfg.package ]; systemd.services.gitlab-runner = { description = "Gitlab Runner"; |