mirror of
https://github.com/NixOS/nixpkgs.git
synced 2025-06-12 04:35:41 +03:00
84af416af6
Over time, we added a lot of setup services to the ACME module, namely: - acme-selfsigned-ca.service: Creates the selfsigned CA certificates used to generate selfsigned certs for each configured cert. - acme-fixperms.service: Ensures permissions correctness on certs after system configuration changes. - acme-lockfiles.service: Create lockfiles used to implement maxConcurrentRenewals. These numerous setup services complicated the dependency chain for any cert renewal, and also made it difficult to track responsibility for specific setup steps, for example, creating /var/lib/acme or setting permissions of shared folders. This change proposes a new acme-setup.service which encapsulates the functionality of the previous 3 services into one. The service is still defined in 3 separate chunks (using lib.mkMerge) which allows us to keep a logical separation between each step and preserve some optionality in the features. The result is a generally simplified definition of systemd unit dependencies and an obvious entrypoint for future setup extensions. |
||
|---|---|---|
| .. | ||
| acme | ||
| apparmor | ||
| krb5 | ||
| wrappers | ||
| apparmor.nix | ||
| audit.nix | ||
| auditd.nix | ||
| ca.nix | ||
| chromium-suid-sandbox.nix | ||
| dhparams.nix | ||
| doas.nix | ||
| duosec.nix | ||
| google_oslogin.nix | ||
| ipa.nix | ||
| isolate.nix | ||
| lock-kernel-modules.nix | ||
| misc.nix | ||
| oath.nix | ||
| pam.nix | ||
| pam_mount.nix | ||
| please.nix | ||
| polkit.nix | ||
| rngd.nix | ||
| rtkit.nix | ||
| soteria.nix | ||
| sudo-rs.nix | ||
| sudo.nix | ||
| systemd-confinement.nix | ||
| tpm2.nix | ||