From 6b766b111da05db801de35daf6ca4134769d6a25 Mon Sep 17 00:00:00 2001
From: Luke Granger-Brown <hg@lukegb.com>
Date: Mon, 27 Sep 2021 08:00:41 +0000
Subject: [PATCH] bvm-radius: make sure nginx can see certificates

---
 ops/nixos/bvm-radius/default.nix | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/ops/nixos/bvm-radius/default.nix b/ops/nixos/bvm-radius/default.nix
index e8de9a61b3..17c3f65f03 100644
--- a/ops/nixos/bvm-radius/default.nix
+++ b/ops/nixos/bvm-radius/default.nix
@@ -2,7 +2,7 @@
 #
 # SPDX-License-Identifier: Apache-2.0
 
-{ config, depot, pkgs, ... }:
+{ config, depot, lib, pkgs, ... }:
 let
   inherit (depot.ops) secrets;
 in {
@@ -64,6 +64,7 @@ in {
       '';
     };
   };
+  users.users.nginx.extraGroups = lib.mkAfter [ "acme" ];
 
   system.stateVersion = "21.05";
 }