20 lines
1.1 KiB
Diff
20 lines
1.1 KiB
Diff
diff --git a/nixos/modules/services/web-servers/pomerium.nix b/nixos/modules/services/web-servers/pomerium.nix
|
|
--- a/nixos/modules/services/web-servers/pomerium.nix
|
|
+++ b/nixos/modules/services/web-servers/pomerium.nix
|
|
@@ -99,7 +99,6 @@ in
|
|
AmbientCapabilities = [ "CAP_NET_BIND_SERVICE" ];
|
|
CapabilityBoundingSet = [ "CAP_NET_BIND_SERVICE" ];
|
|
|
|
- WorkingDirectory = mkIf (cfg.useACMEHost != null) "$CREDENTIALS_DIRECTORY";
|
|
LoadCredential = optionals (cfg.useACMEHost != null) [
|
|
"fullchain.pem:/var/lib/acme/${cfg.useACMEHost}/fullchain.pem"
|
|
"key.pem:/var/lib/acme/${cfg.useACMEHost}/key.pem"
|
|
@@ -119,7 +118,7 @@ in
|
|
before = [ "acme-finished-${cfg.useACMEHost}.target" ];
|
|
after = [ "acme-${cfg.useACMEHost}.service" ];
|
|
# Block reloading if not all certs exist yet.
|
|
- unitConfig.ConditionPathExists = [ "${certs.${cfg.useACMEHost}.directory}/fullchain.pem" ];
|
|
+ unitConfig.ConditionPathExists = [ "${config.security.acme.certs.${cfg.useACMEHost}.directory}/fullchain.pem" ];
|
|
serviceConfig = {
|
|
Type = "oneshot";
|
|
TimeoutSec = 60;
|