nathan/nixpkgs
1
0
Fork 0
mirror of https://github.com/NixOS/nixpkgs.git synced 2026-09-29 19:30:11 +00:00
Code Issues Packages Projects Releases Wiki Activity

keycloak service: update HTTPS configuration

Browse Source 
Keycloak 16.1.0 uses different way to configure HTTPS.
This requires us to order commands correctly, otherwise linked
objects will fail.

(cherry picked from commit 827267a27f)
This commit is contained in:
Nikolay Amiantov
2022-01-10 00:43:45 +03:00
committed by github-actions[bot]
parent f483cdd569
commit b0e3fee9f1
1 changed files with 16 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

20
nixos/modules/services/web-apps/keycloak.nix
View File

@@ -345,11 +345,23 @@ in
})
(lib.optionalAttrs (cfg.sslCertificate != null && cfg.sslCertificateKey != null) {
"socket-binding-group=standard-sockets"."socket-binding=https".port = cfg.httpsPort;
"core-service=management"."security-realm=UndertowRealm"."server-identity=ssl" = {
keystore-path = "/run/keycloak/ssl/certificate_private_key_bundle.p12";
keystore-password = "notsosecretpassword";
"subsystem=elytron" = lib.mkOrder 900 {
"key-store=httpsKS" = lib.mkOrder 900 {
path = "/run/keycloak/ssl/certificate_private_key_bundle.p12";
credential-reference.clear-text = "notsosecretpassword";
type = "JKS";
};
"key-manager=httpsKM" = lib.mkOrder 901 {
key-store = "httpsKS";
credential-reference.clear-text = "notsosecretpassword";
};
"server-ssl-context=httpsSSC" = lib.mkOrder 902 {
key-manager = "httpsKM";
};
};
"subsystem=undertow" = lib.mkOrder 901 {
"server=default-server"."https-listener=https".ssl-context = "httpsSSC";
};
"subsystem=undertow"."server=default-server"."https-listener=https".security-realm = "UndertowRealm";
})
cfg.extraConfig
];