From 116ae00e73d78e723b813b8872553c68cbcb1dac Mon Sep 17 00:00:00 2001
From: Moritz Hedtke <Moritz.Hedtke@t-online.de>
Date: Wed, 15 Dec 2021 20:27:18 +0100
Subject: [PATCH] nixos/step-ca: create a step-ca user

This allows you to create the certificate files owned by that user so the service can read them.
---
 nixos/modules/services/security/step-ca.nix | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/nixos/modules/services/security/step-ca.nix b/nixos/modules/services/security/step-ca.nix
index 27b2ceed1a43..bfb29fbc6c15 100644
--- a/nixos/modules/services/security/step-ca.nix
+++ b/nixos/modules/services/security/step-ca.nix
@@ -108,6 +108,9 @@ in
           ConditionFileNotEmpty = ""; # override upstream
         };
         serviceConfig = {
+          User = "step-ca";
+          Group = "step-ca";
+          UMask = "0077";
           Environment = "HOME=%S/step-ca";
           WorkingDirectory = ""; # override upstream
           ReadWriteDirectories = ""; # override upstream
@@ -129,6 +132,14 @@ in
         };
       };
 
+      users.users.step-ca = {
+        home = "/var/lib/step-ca";
+        group = "step-ca";
+        isSystemUser = true;
+      };
+
+      users.groups.step-ca = {};
+
       networking.firewall = lib.mkIf cfg.openFirewall {
         allowedTCPPorts = [ cfg.port ];
       };