From 8c51e99b96d8cf75782e63341be41805167cbe28 Mon Sep 17 00:00:00 2001
From: provokateurin <kate@provokateurin.de>
Date: Sat, 24 May 2025 19:13:31 +0200
Subject: [PATCH] nixos/step-ca: Allow not configuring the
 intermediatePasswordFile

It is not necessary for the intermediate certificate to have a password set,
but currently the intermediatePasswordFile value is always accessed to load the credential.
---
 nixos/modules/services/security/step-ca.nix | 22 +++++++++++++++------
 1 file changed, 16 insertions(+), 6 deletions(-)

diff --git a/nixos/modules/services/security/step-ca.nix b/nixos/modules/services/security/step-ca.nix
index d7ed2acf7664..746d3c0b3839 100644
--- a/nixos/modules/services/security/step-ca.nix
+++ b/nixos/modules/services/security/step-ca.nix
@@ -55,10 +55,13 @@ in
         '';
       };
       intermediatePasswordFile = lib.mkOption {
-        type = lib.types.pathWith {
-          inStore = false;
-          absolute = true;
-        };
+        type = lib.types.nullOr (
+          lib.types.pathWith {
+            inStore = false;
+            absolute = true;
+          }
+        );
+        default = null;
         example = "/run/keys/smallstep-password";
         description = ''
           Path to the file containing the password for the intermediate
@@ -104,11 +107,18 @@ in
           ReadWritePaths = ""; # override upstream
 
           # LocalCredential handles file permission problems arising from the use of DynamicUser.
-          LoadCredential = "intermediate_password:${cfg.intermediatePasswordFile}";
+          LoadCredential = lib.mkIf (
+            cfg.intermediatePasswordFile != null
+          ) "intermediate_password:${cfg.intermediatePasswordFile}";
 
           ExecStart = [
             "" # override upstream
-            "${cfg.package}/bin/step-ca /etc/smallstep/ca.json --password-file \${CREDENTIALS_DIRECTORY}/intermediate_password"
+            (
+              "${cfg.package}/bin/step-ca /etc/smallstep/ca.json"
+              + lib.optionalString (
+                cfg.intermediatePasswordFile != null
+              ) " --password-file \${CREDENTIALS_DIRECTORY}/intermediate_password"
+            )
           ];
 
           # ProtectProc = "invisible"; # not supported by upstream yet