3p/nixpkgs: remove WorkingDirectory from pomerium too
This commit is contained in:
parent
3359a8d6b4
commit
31811e480b
2 changed files with 9 additions and 2 deletions
|
@ -99,7 +99,6 @@ in
|
|||
AmbientCapabilities = [ "CAP_NET_BIND_SERVICE" ];
|
||||
CapabilityBoundingSet = [ "CAP_NET_BIND_SERVICE" ];
|
||||
|
||||
WorkingDirectory = mkIf (cfg.useACMEHost != null) "$CREDENTIALS_DIRECTORY";
|
||||
LoadCredential = optionals (cfg.useACMEHost != null) [
|
||||
"fullchain.pem:/var/lib/acme/${cfg.useACMEHost}/fullchain.pem"
|
||||
"key.pem:/var/lib/acme/${cfg.useACMEHost}/key.pem"
|
||||
|
|
10
third_party/nixpkgs/patches/pomerium-fix.patch
vendored
10
third_party/nixpkgs/patches/pomerium-fix.patch
vendored
|
@ -1,7 +1,15 @@
|
|||
diff --git a/nixos/modules/services/web-servers/pomerium.nix b/nixos/modules/services/web-servers/pomerium.nix
|
||||
--- a/nixos/modules/services/web-servers/pomerium.nix
|
||||
+++ b/nixos/modules/services/web-servers/pomerium.nix
|
||||
@@ -119,7 +119,7 @@ in
|
||||
@@ -99,7 +99,6 @@ in
|
||||
AmbientCapabilities = [ "CAP_NET_BIND_SERVICE" ];
|
||||
CapabilityBoundingSet = [ "CAP_NET_BIND_SERVICE" ];
|
||||
|
||||
- WorkingDirectory = mkIf (cfg.useACMEHost != null) "$CREDENTIALS_DIRECTORY";
|
||||
LoadCredential = optionals (cfg.useACMEHost != null) [
|
||||
"fullchain.pem:/var/lib/acme/${cfg.useACMEHost}/fullchain.pem"
|
||||
"key.pem:/var/lib/acme/${cfg.useACMEHost}/key.pem"
|
||||
@@ -119,7 +118,7 @@ in
|
||||
before = [ "acme-finished-${cfg.useACMEHost}.target" ];
|
||||
after = [ "acme-${cfg.useACMEHost}.service" ];
|
||||
# Block reloading if not all certs exist yet.
|
||||
|
|
Loading…
Reference in a new issue