From 2936a95efdc62d6dea053d57a56ad9206599db29 Mon Sep 17 00:00:00 2001 From: Vincent Ambo Date: Thu, 15 Jun 2023 23:20:19 +0300 Subject: fix(ops/modules/quassel): use systemd LoadCredential to read certs This avoids permission issues with nginx vs. quassel Change-Id: I770f8284d8fd8fc6d38add93c1681f9daebe8749 Reviewed-on: https://cl.tvl.fyi/c/depot/+/8786 Reviewed-by: tazjin Tested-by: BuildkiteCI --- ops/modules/quassel.nix | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) (limited to 'ops') diff --git a/ops/modules/quassel.nix b/ops/modules/quassel.nix index 275e2809d7..6acb0615f4 100644 --- a/ops/modules/quassel.nix +++ b/ops/modules/quassel.nix @@ -55,7 +55,7 @@ in "--port=${toString cfg.port}" "--configdir=/var/lib/quassel" "--require-ssl" - "--ssl-cert=/var/lib/acme/${cfg.acmeHost}/full.pem" + "--ssl-cert=$CREDENTIALS_DIRECTORY/quassel.pem" "--loglevel=${cfg.logLevel}" ]; @@ -64,6 +64,10 @@ in User = "quassel"; Group = "quassel"; StateDirectory = "quassel"; + + # Avoid trouble with the ACME file permissions by using the + # systemd credentials feature. + LoadCredential = "quassel.pem:/var/lib/acme/${cfg.acmeHost}/full.pem"; }; }; -- cgit 1.4.1