movefasta/nixpkgs
0
0
Fork 0
mirror of https://github.com/NixOS/nixpkgs.git synced 2025-07-13 13:40:28 +03:00
Code Activity

nixos/acme: Fix cert renewal with built in webserver

Browse source 
Fixes #191794

Lego threw a permission denied error binding to port 80.
AmbientCapabilities with CAP_NET_BIND_SERVICE was required.
Also added a test for this.
This commit is contained in:
Lucas Savva 2022-09-18 21:27:11 +01:00 • committed by Winter
parent 22d41f921f
commit 39796cad46
2 changed files with 21 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

1
nixos/modules/security/acme/default.nix
View file

@ -325,6 +325,7 @@ let
'');
} // optionalAttrs (data.listenHTTP != null && toInt (elemAt (splitString ":" data.listenHTTP) 1) < 1024) {
CapabilityBoundingSet = [ "CAP_NET_BIND_SERVICE" ];
AmbientCapabilities = [ "CAP_NET_BIND_SERVICE" ];
};
# Working directory will be /tmp