From 994c56c88148852a128e9830492a89d1c8d1f53f Mon Sep 17 00:00:00 2001 From: Pedro Alves Date: Sat, 15 Mar 2025 11:47:07 +0000 Subject: [PATCH] nixos/cloudflared: remove assertion for certificateFile While it is probably a mistake in configuration to have declarative routes configured but no certificate file, it is not always necessary to have a working set up, so the assertion was removed. The documentation for the certificateFile setting was reworked to describe this. --- nixos/modules/services/networking/cloudflared.nix | 12 ++++-------- 1 file changed, 4 insertions(+), 8 deletions(-) diff --git a/nixos/modules/services/networking/cloudflared.nix b/nixos/modules/services/networking/cloudflared.nix index 3303099295d4..dd03daefe710 100644 --- a/nixos/modules/services/networking/cloudflared.nix +++ b/nixos/modules/services/networking/cloudflared.nix @@ -10,9 +10,11 @@ let certificateFile = lib.mkOption { type = with lib.types; nullOr path; description = '' - Cert.pem file. + Account certificate file, necessary to create, delete and manage tunnels. It can be obtained by running `cloudflared login`. - See [Cert.pem](https://developers.cloudflare.com/cloudflare-one/connections/connect-apps/install-and-setup/tunnel-useful-terms/#certpem). + Note that this is **necessary** for a fully declarative set up, as routes can not otherwise be created outside of the Cloudflare interface. + + See [Cert.pem](https://developers.cloudflare.com/cloudflare-one/connections/connect-apps/install-and-setup/tunnel-useful-terms/#certpem) for information about the file, and [Tunnel permissions](https://developers.cloudflare.com/cloudflare-one/connections/connect-networks/do-more-with-tunnels/local-management/tunnel-permissions/) for a comparison between the account certificate and the tunnel credentials file. ''; default = null; }; @@ -301,12 +303,6 @@ in }; config = lib.mkIf cfg.enable { - assertions = lib.mapAttrsToList (name: tunnel: { - assertion = - tunnel.ingress == { } || (cfg.certificateFile != null || tunnel.certificateFile != null); - message = "Cloudflare Tunnel ${name} has a declarative configuration, but no certificate file was defined."; - }) cfg.tunnels; - systemd.targets = lib.mapAttrs' ( name: tunnel: lib.nameValuePair "cloudflared-tunnel-${name}" {