The acmedns backend consumes a ACME_DNS_STORAGE_PATH environment
variable.
Upstream does treat this file as mutable (if you create or delete
accounts through the CLI, it would update it. We don't do this in our
module).
But the possibility for edits is probably why they didn't go with
`ACME_DNS_CONFIG` env var for the contents (as they'd be read-only), or
a `ACME_DNS_CONFIG_FILE`. (And the fact that a
`ACME_DNS_STORAGE_PATH_FILE` env var with questionable usability exists
is due to this logic being generic for most env vars).
So instead of fighting upstream over this, let's simply make our module
assertion also accept `_PATH` suffixes for `credentialFiles`.
Fixes#344684.
We concluded this is fine, because we don't require elevation while
switching generations.
Co-Authored-By: r-vdp <ramses@well-founded.dev>
Co-Authored-By: Grimmauld <Grimmauld@grimmauld.de>
The module now enables polkit, which run0 requires to faciliate
elevation. This warrants guarding the config by an opt-in enable toggle.
For the options that existed prior to the enable toggle we now assert
that users need to opt into the module for them to have an effect.
This module was deprecated in 26.05 and is being removed in 26.11.
Generating your own dhparams has been obsoleted by RFC 7919 (2016).
DHE itself has been obsoleted by ECHDE (RFC8422, 2018) and Hybrid PQ
(draft-ietf-tls-ecdhe-mlkem, 2026) key exchanges.
TLS 1.3 (RFC8446, 2018) stopped defining any DHE cipher suites and lists
this as a major difference from TLS 1.2.
In containers, it can be reasonable to have no interactive logins at all
and to run the container entirely 'lights out'. In this setting, PAM is
dead weight, and adds considerably to container image size (mostly by
bringing other things in to the closure). However, presently, there's no
way to get rid of it.
This change adds the coarse tool of entirely disabling PAM. There
_could_ be a warning or even an assertion, but I reasoned that there
might be odd cases where it's desired - and not having PAM is not
something that entirely disables the system, so a hard assertion feels
wrong, and there are plenty of other ways to misconfigure a system if
you go looking for trouble. I am also trying not to get sucked in to the
morass of reforming pam.nix more broadly to make it less cumbersome,
hence the coarsity of the setting.
`pkgs.glibcLocales` is null for musl systems, so
`options.i18n.glibcLocales` needs to also be nullable.
otherwise, the `.override` and subsequence path interpolations
fail for non-gnu systems.
Generating your own dhparams has been obsoleted by RFC 7919 (2016).
DHE itself has been obsoleted by ECHDE (RFC8422, 2018) and Hybrid PQ
(draft-ietf-tls-ecdhe-mlkem, 2026) key exchanges.
TLS 1.3 (RFC8446, 2018) stopped defining any DHE cipher suites and lists
this as a major difference from TLS 1.2.
Per https://github.com/NixOS/nixpkgs/issues/96006, this does not work as
expected.
The warning trace will be emitted regardless of whether the option is
set, rendering it pointless. It does not work at the top-level either
(i.e. as `"security" "acme" "defaults" "credentialsFile"`), As such,
remove it entirely.
TheRealGramdalf