cafkafk/nixpkgs
cafkafk/nixpkgs
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 2

nixos/bitwarden_rs: add environmentFile option

Browse source 
Add the option `environmentFile` to allow passing secrets to the service
without adding them to the Nix store, while keeping the current
configuration via the existing environment file intact.
This commit is contained in:
WilliButz 2020-09-07 16:39:18 +02:00
parent 7bd175ca3b
commit 76362dd7eb
No known key found for this signature in database
GPG key ID: 92582A10F1179CB2
1 changed files with 18 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

19
nixos/modules/services/security/bitwarden_rs/default.nix
View file

@ -81,6 +81,23 @@ in {
<link xlink:href="https://github.com/dani-garcia/bitwarden_rs/blob/${bitwarden_rs.version}/.env.template">the environment template file</link>.
'';
};
environmentFile = mkOption {
type = with types; nullOr path;
default = null;
example = "/root/bitwarden_rs.env";
description = ''
Additional environment file as defined in <citerefentry>
<refentrytitle>systemd.exec</refentrytitle><manvolnum>5</manvolnum>
</citerefentry>.
Secrets like <envar>ADMIN_TOKEN</envar> and <envar>SMTP_PASSWORD</envar>
may be passed to the service without adding them to the world-readable Nix store.
Note that this file needs to be available on the host on which
<literal>bitwarden_rs</literal> is running.
'';
};
};
config = mkIf cfg.enable {
@ -101,7 +118,7 @@ in {
serviceConfig = {
User = user;
Group = group;
EnvironmentFile = configFile;
EnvironmentFile = [ configFile ] ++ optional (cfg.environmentFile != null) cfg.environmentFile;
ExecStart = "${bitwarden_rs}/bin/bitwarden_rs";
LimitNOFILE = "1048576";
LimitNPROC = "64";