nathan/nixpkgs
1
0
Fork 0
mirror of https://github.com/NixOS/nixpkgs.git synced 2026-10-02 13:00:23 +00:00
Code Issues Packages Projects Releases Wiki Activity

[Backport release-25.05] nixos/step-ca: Allow not configuring the intermediatePasswordFile (#459700)

Browse Source
This commit is contained in:
Yureka
2025-11-08 09:19:22 +00:00
committed by GitHub
parent c80356bb1b b259ba0183
commit ea29e9cdbc
1 changed files with 16 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

22
nixos/modules/services/security/step-ca.nix
View File

@@ -60,10 +60,13 @@ in
'';
};
intermediatePasswordFile = lib.mkOption {
type = lib.types.pathWith {
inStore = false;
absolute = true;
};
type = lib.types.nullOr (
lib.types.pathWith {
inStore = false;
absolute = true;
}
);
default = null;
example = "/run/keys/smallstep-password";
description = ''
Path to the file containing the password for the intermediate
@@ -109,11 +112,18 @@ in
ReadWritePaths = ""; # override upstream
# LocalCredential handles file permission problems arising from the use of DynamicUser.
LoadCredential = "intermediate_password:${cfg.intermediatePasswordFile}";
LoadCredential = lib.mkIf (
cfg.intermediatePasswordFile != null
) "intermediate_password:${cfg.intermediatePasswordFile}";
ExecStart = [
"" # override upstream
"${cfg.package}/bin/step-ca /etc/smallstep/ca.json --password-file \${CREDENTIALS_DIRECTORY}/intermediate_password"
(
"${cfg.package}/bin/step-ca /etc/smallstep/ca.json"
+ lib.optionalString (
cfg.intermediatePasswordFile != null
) " --password-file \${CREDENTIALS_DIRECTORY}/intermediate_password"
)
];
# ProtectProc = "invisible"; # not supported by upstream yet