movefasta/nixpkgs
0
0
Fork 0
mirror of https://github.com/NixOS/nixpkgs.git synced 2025-07-12 05:16:25 +03:00
Code Activity

acme: share accounts between certificates

Browse source 
There are strict rate limits on account creation for Let's Encrypt
certificates. It is important to reuse credentails when possible.
This commit is contained in:
Lucas Savva 2020-04-13 23:54:44 +01:00
parent 81a6a80436
commit 827d5e6b44
No known key found for this signature in database
GPG key ID: F9CE6D3DCDC78F2D
1 changed files with 2 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

3
nixos/modules/security/acme.nix
View file

@ -330,13 +330,14 @@ in
User = data.user;
Group = data.group;
PrivateTmp = true;
StateDirectory = "acme/.lego/${cert} ${lpath}";
StateDirectory = "acme/.lego/${cert} acme/.lego/accounts ${lpath}";
StateDirectoryMode = if data.allowKeysForGroup then "750" else "700";
WorkingDirectory = spath;
# Only try loading the credentialsFile if the dns challenge is enabled
EnvironmentFile = if data.dnsProvider != null then data.credentialsFile else null;
ExecStart = pkgs.writeScript "acme-start" ''
#!${pkgs.runtimeShell} -e
test -L ${spath}/accounts -o -d ${spath}/accounts || ln -s ../accounts ${spath}/accounts
${pkgs.lego}/bin/lego ${renewOpts} || ${pkgs.lego}/bin/lego ${runOpts}
'';
ExecStartPost =