From 78d07871f5d0785d4d2780894cb2face90e1b303 Mon Sep 17 00:00:00 2001 From: Florian Klink Date: Sun, 21 Jun 2026 23:26:12 +0300 Subject: [PATCH] nixos/acme: also allow _PATH-suffixed credential files The acmedns backend consumes a ACME_DNS_STORAGE_PATH environment variable. Upstream does treat this file as mutable (if you create or delete accounts through the CLI, it would update it. We don't do this in our module). But the possibility for edits is probably why they didn't go with `ACME_DNS_CONFIG` env var for the contents (as they'd be read-only), or a `ACME_DNS_CONFIG_FILE`. (And the fact that a `ACME_DNS_STORAGE_PATH_FILE` env var with questionable usability exists is due to this logic being generic for most env vars). So instead of fighting upstream over this, let's simply make our module assertion also accept `_PATH` suffixes for `credentialFiles`. Fixes #344684. --- nixos/modules/security/acme/default.nix | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/nixos/modules/security/acme/default.nix b/nixos/modules/security/acme/default.nix index 13012e176753..1f09716c6322 100644 --- a/nixos/modules/security/acme/default.nix +++ b/nixos/modules/security/acme/default.nix @@ -826,8 +826,8 @@ let type = lib.types.attrsOf (lib.types.path); inherit (defaultAndText "credentialFiles" { }) default defaultText; description = '' - Environment variables suffixed by "_FILE" to set for the cert's service - for your selected dnsProvider. + Environment variables suffixed by "_FILE" or "_PATH" to set for the + cert's service for your selected dnsProvider. To find out what values you need to set, consult the documentation at for the corresponding dnsProvider. This allows to securely pass credential files to lego by leveraging systemd @@ -1186,10 +1186,13 @@ in } ) { - assertion = lib.all (lib.hasSuffix "_FILE") (lib.attrNames data.credentialFiles); + assertion = lib.all (n: lib.hasSuffix "_FILE" n || lib.hasSuffix "_PATH" n) ( + lib.attrNames data.credentialFiles + ); + message = '' Option `security.acme.certs.${cert}.credentialFiles` can only be - used for variables suffixed by "_FILE". + used for variables suffixed by "_FILE" or "_PATH". ''; }