b12f/nixpkgs
1
0
Fork 0
Code Issues Pull requests Packages Projects Releases Wiki Activity

Merge pull request #179155 from linj-fork/caddy-improve-security

Browse source 
nixos/caddy: improve security about acme certs
This commit is contained in:
Bernardo Meurer 2022-08-25 10:36:10 -03:00 committed by GitHub
parent c6c6cad06d f7baa65db7
commit d05ae63d23
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
2 changed files with 6 additions and 6 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

8
nixos/modules/services/web-servers/caddy/default.nix
View file

@ -308,7 +308,6 @@ in
StateDirectory = mkIf (cfg.dataDir == "/var/lib/caddy") [ "caddy" ]; StateDirectory = mkIf (cfg.dataDir == "/var/lib/caddy") [ "caddy" ];
LogsDirectory = mkIf (cfg.logDir == "/var/log/caddy") [ "caddy" ]; LogsDirectory = mkIf (cfg.logDir == "/var/log/caddy") [ "caddy" ];
Restart = "on-abnormal"; Restart = "on-abnormal";
SupplementaryGroups = mkIf (length acmeVHosts != 0) [ "acme" ];
# TODO: attempt to upstream these options # TODO: attempt to upstream these options
NoNewPrivileges = true; NoNewPrivileges = true;
@ -331,9 +330,12 @@ in
security.acme.certs = security.acme.certs =
let let
reloads = map (useACMEHost: nameValuePair useACMEHost { reloadServices = [ "caddy.service" ]; }) acmeHosts; certCfg = map (useACMEHost: nameValuePair useACMEHost {
group = mkDefault cfg.group;
reloadServices = [ "caddy.service" ];
}) acmeHosts;
in in
listToAttrs reloads; listToAttrs certCfg;
}; };
} }

4
nixos/modules/services/web-servers/caddy/vhost-options.nix
View file

@ -40,9 +40,7 @@ in
<emphasis>Note that this option does not create any certificates, nor <emphasis>Note that this option does not create any certificates, nor
does it add subdomains to existing ones – you will need to create them does it add subdomains to existing ones – you will need to create them
manually using <xref linkend="opt-security.acme.certs"/>. Additionally, manually using <xref linkend="opt-security.acme.certs"/>.</emphasis>
you should probably add the <literal>caddy</literal> user to the
<literal>acme</literal> group to grant access to the certificates.</emphasis>
''; '';
}; };