diff options
| author | Luke Granger-Brown <git@lukegb.com> | 2022-03-13 02:20:38 +0000 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2022-03-13 02:20:38 +0000 |
| commit | 8035c513e36fc2db98948a3eeaa2a0fdc1a1e853 (patch) | |
| tree | 08fbf6902d2680092721fe6762a08fd8801bc3d0 /nixos/modules | |
| parent | c01da72106d756201602328f9a0c7bf419b9f34d (diff) | |
| parent | c19e76b29f7bd0d225ab89feb0a3726676f915c8 (diff) | |
Merge pull request #163673 from lukegb/pomerium
pomerium: 0.15.7 -> 0.17.0
Diffstat (limited to 'nixos/modules')
| -rw-r--r-- | nixos/modules/services/web-servers/pomerium.nix | 10 |
1 files changed, 7 insertions, 3 deletions
diff --git a/nixos/modules/services/web-servers/pomerium.nix b/nixos/modules/services/web-servers/pomerium.nix index 2bc7d01c7c28..0b460755f50e 100644 --- a/nixos/modules/services/web-servers/pomerium.nix +++ b/nixos/modules/services/web-servers/pomerium.nix @@ -69,11 +69,16 @@ in CERTIFICATE_KEY_FILE = "key.pem"; }; startLimitIntervalSec = 60; + script = '' + if [[ -v CREDENTIALS_DIRECTORY ]]; then + cd "$CREDENTIALS_DIRECTORY" + fi + exec "${pkgs.pomerium}/bin/pomerium" -config "${cfgFile}" + ''; serviceConfig = { DynamicUser = true; StateDirectory = [ "pomerium" ]; - ExecStart = "${pkgs.pomerium}/bin/pomerium -config ${cfgFile}"; PrivateUsers = false; # breaks CAP_NET_BIND_SERVICE MemoryDenyWriteExecute = false; # breaks LuaJIT @@ -99,7 +104,6 @@ in AmbientCapabilities = [ "CAP_NET_BIND_SERVICE" ]; CapabilityBoundingSet = [ "CAP_NET_BIND_SERVICE" ]; - WorkingDirectory = mkIf (cfg.useACMEHost != null) "$CREDENTIALS_DIRECTORY"; LoadCredential = optionals (cfg.useACMEHost != null) [ "fullchain.pem:/var/lib/acme/${cfg.useACMEHost}/fullchain.pem" "key.pem:/var/lib/acme/${cfg.useACMEHost}/key.pem" @@ -124,7 +128,7 @@ in Type = "oneshot"; TimeoutSec = 60; ExecCondition = "/run/current-system/systemd/bin/systemctl -q is-active pomerium.service"; - ExecStart = "/run/current-system/systemd/bin/systemctl restart pomerium.service"; + ExecStart = "/run/current-system/systemd/bin/systemctl --no-block restart pomerium.service"; }; }; }); |