From b0e3fee9f1e56fe7fe2bb9686fa759337e5b3743 Mon Sep 17 00:00:00 2001 From: Nikolay Amiantov Date: Mon, 10 Jan 2022 00:43:45 +0300 Subject: [PATCH] keycloak service: update HTTPS configuration Keycloak 16.1.0 uses different way to configure HTTPS. This requires us to order commands correctly, otherwise linked objects will fail. (cherry picked from commit 827267a27f300a8fe503986da2570bc3b9252e69) --- nixos/modules/services/web-apps/keycloak.nix | 20 ++++++++++++++++---- 1 file changed, 16 insertions(+), 4 deletions(-) diff --git a/nixos/modules/services/web-apps/keycloak.nix b/nixos/modules/services/web-apps/keycloak.nix index 76cb41a35652..df39d2613efb 100644 --- a/nixos/modules/services/web-apps/keycloak.nix +++ b/nixos/modules/services/web-apps/keycloak.nix @@ -345,11 +345,23 @@ in }) (lib.optionalAttrs (cfg.sslCertificate != null && cfg.sslCertificateKey != null) { "socket-binding-group=standard-sockets"."socket-binding=https".port = cfg.httpsPort; - "core-service=management"."security-realm=UndertowRealm"."server-identity=ssl" = { - keystore-path = "/run/keycloak/ssl/certificate_private_key_bundle.p12"; - keystore-password = "notsosecretpassword"; + "subsystem=elytron" = lib.mkOrder 900 { + "key-store=httpsKS" = lib.mkOrder 900 { + path = "/run/keycloak/ssl/certificate_private_key_bundle.p12"; + credential-reference.clear-text = "notsosecretpassword"; + type = "JKS"; + }; + "key-manager=httpsKM" = lib.mkOrder 901 { + key-store = "httpsKS"; + credential-reference.clear-text = "notsosecretpassword"; + }; + "server-ssl-context=httpsSSC" = lib.mkOrder 902 { + key-manager = "httpsKM"; + }; + }; + "subsystem=undertow" = lib.mkOrder 901 { + "server=default-server"."https-listener=https".ssl-context = "httpsSSC"; }; - "subsystem=undertow"."server=default-server"."https-listener=https".security-realm = "UndertowRealm"; }) cfg.extraConfig ];