fix(wpcarro/diogenes): Ensure quassel can read ACME cert r/3536

Add quassel to the nginx group because only user=acme and group=nginx can read
/var/lib/acme/*

Change-Id: If456b8ebf43ee098cd8007c3c6235c78c1071250
Reviewed-on: https://cl.tvl.fyi/c/depot/+/4752
Tested-by: BuildkiteCI
Reviewed-by: wpcarro <wpcarro@gmail.com>
Autosubmit: wpcarro <wpcarro@gmail.com>

1 files changed, 3 insertions, 0 deletions

diff --git a/users/wpcarro/nixos/diogenes/default.nix b/users/wpcarro/nixos/diogenes/default.nix
index 13fb046a24..b253dd3a24 100644
--- a/users/wpcarro/nixos/diogenes/default.nix
+++ b/users/wpcarro/nixos/diogenes/default.nix
@@ -58,6 +58,9 @@ in wpcarro.terraform.googleCloudVM {
           openssh.authorizedKeys.keys = wpcarro.keys.all;
           shell = pkgs.fish;
         };
+        # This is required so that quasselcore can read the ACME cert in
+        # /var/lib/acme, which is only available to user=acme or group=nginx.
+        quassel.extraGroups = [ "nginx" ];
       };
     };