gador/nixpkgs
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
1,049,718 Commits 9 Branches 0 Tags
current
Commit Graph
7 Commits
Author SHA1 Message Date
Arian van Putten e142ebef75 nixos/spire: make Workload API socket reachable by non-root workloads 
The unit's UMask=0027 was masking spire-agent's own
os.MkdirAll("/run/spire/agent/public", 0755) down to mode 0750, so any
process not in the spire-agent group got EACCES on connect() — defeating
the point of workload attestation, which is supposed to identify
arbitrary callers regardless of their unix identity.

Pre-create the directory via RuntimeDirectory so systemd applies
RuntimeDirectoryMode (0755) independent of umask; spire-agent's MkdirAll
then becomes a no-op.

Also exercises the path in the NixOS test by fetching an SVID as a
normal user.
 2026-05-04 14:50:21 +02:00
Arian van Putten e27ef5378c nixos/spire: add spire-tpm-plugin support 2026-04-27 14:37:44 +02:00
Arian van Putten 89952b521a nixos/spire: update descriptions to match docs 
Copied the descriptions verbatim from upstream
 2026-04-27 14:37:44 +02:00
Arian van Putten 66aad88635 nixos/spire: add join_token and join_token_file options 2026-04-27 14:37:44 +02:00
Arian van Putten 321694cb3f nixos/spire: type server NodeAttestor plugins 2026-04-27 14:37:44 +02:00
Arian van Putten bcad0af499 nixos/spire: type agent NodeAttestor plugin section 2026-04-26 11:25:15 +02:00
Arian van Putten e5d8795180 nixos/spire: init 2026-02-27 11:42:34 +01:00