diff options
| author | github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> | 2021-10-26 00:02:18 +0000 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2021-10-26 00:02:18 +0000 |
| commit | 47ad670e1483b406ef37ece6ca307df1e9cdc09d (patch) | |
| tree | a41cf9422ebfdaa13a648de87fb4da4b53e95a2f /nixos/modules/security | |
| parent | 419f79491defe9fb16727454cf9b26a7c8c7415a (diff) | |
| parent | 0753497619c480f218f4a9049c9253295abbb319 (diff) | |
| download | nixpkgs-47ad670e1483b406ef37ece6ca307df1e9cdc09d.tar nixpkgs-47ad670e1483b406ef37ece6ca307df1e9cdc09d.tar.gz nixpkgs-47ad670e1483b406ef37ece6ca307df1e9cdc09d.tar.bz2 nixpkgs-47ad670e1483b406ef37ece6ca307df1e9cdc09d.tar.lz nixpkgs-47ad670e1483b406ef37ece6ca307df1e9cdc09d.tar.xz nixpkgs-47ad670e1483b406ef37ece6ca307df1e9cdc09d.tar.zst nixpkgs-47ad670e1483b406ef37ece6ca307df1e9cdc09d.zip | |
Merge staging-next into staging
Diffstat (limited to 'nixos/modules/security')
| -rw-r--r-- | nixos/modules/security/acme.nix | 10 |
1 files changed, 10 insertions, 0 deletions
diff --git a/nixos/modules/security/acme.nix b/nixos/modules/security/acme.nix index f522b7c4128..cfbc8e91903 100644 --- a/nixos/modules/security/acme.nix +++ b/nixos/modules/security/acme.nix @@ -192,6 +192,14 @@ let ++ data.extraLegoRenewFlags ); + # We need to collect all the ACME webroots to grant them write + # access in the systemd service. + webroots = + lib.remove null + (lib.unique + (builtins.map + (certAttrs: certAttrs.webroot) + (lib.attrValues config.security.acme.certs))); in { inherit accountHash cert selfsignedDeps; @@ -288,6 +296,8 @@ let "acme/.lego/accounts/${accountHash}" ]; + ReadWritePaths = commonServiceConfig.ReadWritePaths ++ webroots; + # Needs to be space separated, but can't use a multiline string because that'll include newlines BindPaths = [ "${accountDir}:/tmp/accounts" |