movefasta/nixpkgs
0
0
Fork 0
mirror of https://github.com/NixOS/nixpkgs.git synced 2025-07-09 12:05:50 +03:00
Code Activity

Merge pull request #317257 from arianvp/stephank-fix-acme2

Browse source 
nixos/acme: allow setting security.acme.defaults.server = null to keep old accounts directory
This commit is contained in:
Arian van Putten 2024-06-04 21:58:25 +02:00 • committed by GitHub
commit 605418f9b1
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
2 changed files with 11 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

10
nixos/doc/manual/release-notes/rl-2405.section.md
View file

@ -429,6 +429,16 @@ Use `services.pipewire.extraConfig` or `services.pipewire.configPackages` for Pi
- `screen`'s module has been cleaned, and will now require you to set `programs.screen.enable` in order to populate `screenrc` and add the program to the environment. - `screen`'s module has been cleaned, and will now require you to set `programs.screen.enable` in order to populate `screenrc` and add the program to the environment.
- `security.acme.defaults.server` now has a default value instead of `null`.
This effectively uses the same server, the Let's Encrypt production server,
but makes the default explicit, instead of relying on the Lego default.
A side effect of this is that the directory in which account data is stored
changes and the ACME module will request a new account and new certificates
for all domains. This may cause issues if you pin an `acccounturl` in a CAA
DNS record. To avoid this, you
may set `security.acme.defaults.server = null` to keep the old hashes.
- `security.pam.sshAgentAuth.enable` now requires `services.openssh.authorizedKeysFiles` to be non-empty, - `security.pam.sshAgentAuth.enable` now requires `services.openssh.authorizedKeysFiles` to be non-empty,
which is the case when `services.openssh.enable` is true. Previously, `pam_ssh_agent_auth` silently failed to work. which is the case when `services.openssh.enable` is true. Previously, `pam_ssh_agent_auth` silently failed to work.

2
nixos/modules/security/acme/default.nix
View file

@ -545,7 +545,7 @@ let
}; };
server = mkOption { server = mkOption {
type = types.str; type = types.nullOr types.str;
inherit (defaultAndText "server" "https://acme-v02.api.letsencrypt.org/directory") default defaultText; inherit (defaultAndText "server" "https://acme-v02.api.letsencrypt.org/directory") default defaultText;
example = "https://acme-staging-v02.api.letsencrypt.org/directory"; example = "https://acme-staging-v02.api.letsencrypt.org/directory";
description = '' description = ''