cafkafk/nixpkgs
cafkafk/nixpkgs
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 2

nixos/cfssl: use systemd StateDirectory to provision the data directory

Browse source
This commit is contained in:
Aaron Andersen 2022-02-04 16:42:24 -05:00
parent b9393b0c82
commit 67abfde611
1 changed files with 49 additions and 37 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

86
nixos/modules/services/security/cfssl.nix
View file

@ -1,4 +1,4 @@
{ config, lib, pkgs, ... }: { config, options, lib, pkgs, ... }:
with lib; with lib;
@ -11,7 +11,16 @@ in {
dataDir = mkOption { dataDir = mkOption {
default = "/var/lib/cfssl"; default = "/var/lib/cfssl";
type = types.path; type = types.path;
description = "Cfssl work directory."; description = ''
The work directory for CFSSL.
<note><para>
If left as the default value this directory will automatically be
created before the CFSSL server starts, otherwise you are
responsible for ensuring the directory exists with appropriate
ownership and permissions.
</para></note>
'';
}; };
address = mkOption { address = mkOption {
@ -153,7 +162,6 @@ in {
users.extraUsers.cfssl = { users.extraUsers.cfssl = {
description = "cfssl user"; description = "cfssl user";
createHome = true;
home = cfg.dataDir; home = cfg.dataDir;
group = "cfssl"; group = "cfssl";
uid = config.ids.uids.cfssl; uid = config.ids.uids.cfssl;
@ -164,41 +172,45 @@ in {
wantedBy = [ "multi-user.target" ]; wantedBy = [ "multi-user.target" ];
after = [ "network.target" ]; after = [ "network.target" ];
serviceConfig = { serviceConfig = lib.mkMerge [
WorkingDirectory = cfg.dataDir; {
StateDirectory = cfg.dataDir; WorkingDirectory = cfg.dataDir;
StateDirectoryMode = 700; Restart = "always";
Restart = "always"; User = "cfssl";
User = "cfssl";
ExecStart = with cfg; let ExecStart = with cfg; let
opt = n: v: optionalString (v != null) ''-${n}="${v}"''; opt = n: v: optionalString (v != null) ''-${n}="${v}"'';
in in
lib.concatStringsSep " \\\n" [ lib.concatStringsSep " \\\n" [
"${pkgs.cfssl}/bin/cfssl serve" "${pkgs.cfssl}/bin/cfssl serve"
(opt "address" address) (opt "address" address)
(opt "port" (toString port)) (opt "port" (toString port))
(opt "ca" ca) (opt "ca" ca)
(opt "ca-key" caKey) (opt "ca-key" caKey)
(opt "ca-bundle" caBundle) (opt "ca-bundle" caBundle)
(opt "int-bundle" intBundle) (opt "int-bundle" intBundle)
(opt "int-dir" intDir) (opt "int-dir" intDir)
(opt "metadata" metadata) (opt "metadata" metadata)
(opt "remote" remote) (opt "remote" remote)
(opt "config" configFile) (opt "config" configFile)
(opt "responder" responder) (opt "responder" responder)
(opt "responder-key" responderKey) (opt "responder-key" responderKey)
(opt "tls-key" tlsKey) (opt "tls-key" tlsKey)
(opt "tls-cert" tlsCert) (opt "tls-cert" tlsCert)
(opt "mutual-tls-ca" mutualTlsCa) (opt "mutual-tls-ca" mutualTlsCa)
(opt "mutual-tls-cn" mutualTlsCn) (opt "mutual-tls-cn" mutualTlsCn)
(opt "mutual-tls-client-key" mutualTlsClientKey) (opt "mutual-tls-client-key" mutualTlsClientKey)
(opt "mutual-tls-client-cert" mutualTlsClientCert) (opt "mutual-tls-client-cert" mutualTlsClientCert)
(opt "tls-remote-ca" tlsRemoteCa) (opt "tls-remote-ca" tlsRemoteCa)
(opt "db-config" dbConfig) (opt "db-config" dbConfig)
(opt "loglevel" (toString logLevel)) (opt "loglevel" (toString logLevel))
]; ];
}; }
(mkIf (cfg.dataDir == options.services.cfssl.dataDir.default) {
StateDirectory = baseNameOf cfg.dataDir;
StateDirectoryMode = 700;
})
];
}; };
services.cfssl = { services.cfssl = {