movefasta/nixpkgs
0
0
Fork 0
mirror of https://github.com/NixOS/nixpkgs.git synced 2025-07-13 13:40:28 +03:00
Code Activity

nixos/acme: fix cert ownership assert message

Browse source 
Handle the case where a service has no `User` defined in the message
in addition to the assertion itself.
This commit is contained in:
ThinkChaos 2024-12-05 20:15:25 -05:00
parent 55d15ad12a
commit 1e8e314fdb
No known key found for this signature in database
1 changed files with 4 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

7
nixos/modules/security/acme/mk-cert-ownership-assertion.nix
View file

@ -4,18 +4,19 @@ lib:
let
catSep = builtins.concatStringsSep;
svcUser = svc: svc.serviceConfig.User or "root";
svcGroups = svc:
(lib.optional (svc.serviceConfig ? Group) svc.serviceConfig.Group)
++ lib.toList (svc.serviceConfig.SupplementaryGroups or [ ]);
in
{
assertion = builtins.all (svc:
svc.serviceConfig.User or "root" == "root"
|| builtins.elem svc.serviceConfig.User groups.${cert.group}.members
svcUser svc == "root"
|| builtins.elem (svcUser svc) groups.${cert.group}.members
|| builtins.elem cert.group (svcGroups svc)
) services;
message = "Certificate ${cert.domain} (group=${cert.group}) must be readable by service(s) ${
catSep ", " (map (svc: "${svc.name} (user=${svc.serviceConfig.User} groups=${catSep " " (svcGroups svc)})") services)
catSep ", " (map (svc: "${svc.name} (user=${svcUser svc} groups=${catSep "," (svcGroups svc)})") services)
}";
}