dev/nixpkgs
1
0
Fork 0
Code Issues Pull Requests Actions 2 Packages Projects Releases Wiki Activity

nixos/acme: Set /var/lib/acme permissions to 755

Browse Source 
It was being created with the default home permissions of 700, and then
set to 755 at runtime by something either some script or systemd as
part of service startup.

It worked fine without sysusers, but when it's enabed with:

    systemd.sysusers.enable = true;

systemd-tmpfiles is resetting permissions on each activation, which
breaks, for example, nginx reload, because it cannot load certificates
anymore, because it doesn't have any access to `/var/lib/acme`.

Fix this by setting `homeMode = "755";` explicitely so that it's set to
the final value from the beginning.
This commit is contained in:
Yuriy Taraday 2024-11-04 15:49:57 +01:00
parent 4a5e52829b
commit 64a6e8292a
1 changed files with 1 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
nixos/modules/security/acme/default.nix
View File

@ -968,6 +968,7 @@ in {
users.users.acme = {
home = "/var/lib/acme";
homeMode = "755";
group = "acme";
isSystemUser = true;
};