gador/nixpkgs
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

nixos/nginx-sso: use '/run' to generate config

Browse Source 
Closes #461198.
This commit is contained in:
Bruno BELANYI
2025-11-13 10:59:35 +00:00
parent 513678ee60
commit f3b85882a2
2 changed files with 7 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
nixos/doc/manual/release-notes/rl-2511.section.md
View File

@@ -190,6 +190,10 @@
- Linux 5.4 and all its variants have been removed since mainline will reach its end of life within the support-span of 25.11. - Linux 5.4 and all its variants have been removed since mainline will reach its end of life within the support-span of 25.11.
- The `services.nginx.sso` module has switched to generating its configuration
file in `/run`. You should manually delete `/var/lib/nginx-sso/config.yaml` to
avoid storing secret values to disk.
- The `services.polipo` module has been removed as `polipo` is unmaintained and archived upstream. - The `services.polipo` module has been removed as `polipo` is unmaintained and archived upstream.
- `boot.enableContainers` is only turned on when a declarative NixOS container is defined in `containers`. - `boot.enableContainers` is only turned on when a declarative NixOS container is defined in `containers`.

9
nixos/modules/services/security/nginx-sso.nix
View File

@@ -8,7 +8,7 @@
let let
cfg = config.services.nginx.sso; cfg = config.services.nginx.sso;
format = pkgs.formats.yaml { }; format = pkgs.formats.yaml { };
configPath = "/var/lib/nginx-sso/config.yaml"; configPath = "/run/nginx-sso/config.yaml";
secretsReplacement = utils.genJqSecretsReplacement { secretsReplacement = utils.genJqSecretsReplacement {
loadCredential = true; loadCredential = true;
} cfg.configuration configPath; } cfg.configuration configPath;
@@ -60,14 +60,11 @@ in
description = "Nginx SSO Backend"; description = "Nginx SSO Backend";
after = [ "network.target" ]; after = [ "network.target" ];
wantedBy = [ "multi-user.target" ]; wantedBy = [ "multi-user.target" ];
preStart = secretsReplacement.script;
serviceConfig = { serviceConfig = {
StateDirectory = "nginx-sso"; StateDirectory = "nginx-sso";
WorkingDirectory = "/var/lib/nginx-sso"; WorkingDirectory = "/var/lib/nginx-sso";
ExecStartPre = pkgs.writeShellScript "merge-nginx-sso-config" '' RuntimeDirectory = "nginx-sso";
rm -f '${configPath}'
# Relies on YAML being a superset of JSON
${secretsReplacement.script}
'';
ExecStart = '' ExecStart = ''
${lib.getExe cfg.package} \ ${lib.getExe cfg.package} \
--config ${configPath} \ --config ${configPath} \