gador/nixpkgs
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

nixos/acme: fix account creation service ordering

Browse Source 
If the chosen leader was an HTTP service, then the web server would be
both before and after the server.
This commit is contained in:
ThinkChaos
2024-11-09 14:29:05 -05:00
parent b432e86caf
commit 2f52ab637c
1 changed files with 6 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
nixos/modules/security/acme/default.nix
+6 -4
View File
@@ -1017,11 +1017,13 @@ in {
# systemd clean --what=state is used to delete the account, so long as the user
# then runs one of the cert services, there won't be any issues.
accountTargets = lib.mapAttrs' (hash: confs: let
leader = "acme-${(builtins.head confs).cert}.service";
dependantServices = map (conf: "acme-${conf.cert}.service") (builtins.tail confs);
dnsConfs = builtins.filter (conf: cfg.certs.${conf.cert}.dnsProvider != null) confs;
leaderConf = if dnsConfs != [ ] then builtins.head dnsConfs else builtins.head confs;
leader = "acme-${leaderConf.cert}.service";
followers = map (conf: "acme-${conf.cert}.service") (builtins.filter (conf: conf != leaderConf) confs);
in lib.nameValuePair "acme-account-${hash}" {
requiredBy = dependantServices;
before = dependantServices;
requiredBy = followers;
before = followers;
requires = [ leader ];
after = [ leader ];
}) (lib.groupBy (conf: conf.accountHash) (lib.attrValues certConfigs));