diff options
Diffstat (limited to 'nixos/modules/security/acme.nix')
| -rw-r--r-- | nixos/modules/security/acme.nix | 6 |
1 files changed, 3 insertions, 3 deletions
diff --git a/nixos/modules/security/acme.nix b/nixos/modules/security/acme.nix index b787a767539..df5f33c9461 100644 --- a/nixos/modules/security/acme.nix +++ b/nixos/modules/security/acme.nix @@ -301,7 +301,7 @@ in # StateDirectory must be relative, and will be created under /var/lib by systemd lpath = "acme/${cert}"; apath = "/var/lib/${lpath}"; - spath = "/var/lib/acme/.lego"; + spath = "/var/lib/acme/.lego/${cert}"; fileMode = if data.allowKeysForGroup then "640" else "600"; globalOpts = [ "-d" data.domain "--email" data.email "--path" "." "--key-type" data.keyType ] ++ optionals (cfg.acceptTerms) [ "--accept-tos" ] @@ -318,7 +318,7 @@ in description = "Renew ACME Certificate for ${cert}"; after = [ "network.target" "network-online.target" ]; wants = [ "network-online.target" ]; - wantedBy = [ "multi-user.target" ]; + wantedBy = mkIf (!config.boot.isContainer) [ "multi-user.target" ]; serviceConfig = { Type = "oneshot"; # With RemainAfterExit the service is considered active even @@ -330,7 +330,7 @@ in User = data.user; Group = data.group; PrivateTmp = true; - StateDirectory = "acme/.lego ${lpath}"; + StateDirectory = "acme/.lego/${cert} ${lpath}"; StateDirectoryMode = if data.allowKeysForGroup then "750" else "700"; WorkingDirectory = spath; # Only try loading the credentialsFile if the dns challenge is enabled |