b12f/nixpkgs
1
0
Fork 0
Code Issues Pull requests Packages Projects Releases Wiki Activity

nixos/caddy: improve security about acme certs

Browse source 
Before this patch, the caddy process has acme in its supplementary
group because of the SupplementaryGroups in its service config, which
may give it more permission than needed, is inconsistent with the
documentation of services.caddy.virtualHosts.<name>.useACMEHost and is
redundant since we have mkCertOwnershipAssertion in assertions.

This patch fixes these problems by defaulting the group of needed
certs to caddy, which is what other web servers like nginx do and
deleting SupplementaryGroups config.
This commit is contained in:
Lin Jian 2022-06-26 13:19:10 +08:00
parent 608607c410
commit f7baa65db7
No known key found for this signature in database
GPG key ID: A6698D36434F75A5
2 changed files with 6 additions and 6 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

8
nixos/modules/services/web-servers/caddy/default.nix
View file

@ -308,7 +308,6 @@ in
StateDirectory = mkIf (cfg.dataDir == "/var/lib/caddy") [ "caddy" ];
LogsDirectory = mkIf (cfg.logDir == "/var/log/caddy") [ "caddy" ];
Restart = "on-abnormal";
SupplementaryGroups = mkIf (length acmeVHosts != 0) [ "acme" ];
# TODO: attempt to upstream these options
NoNewPrivileges = true;
@ -331,9 +330,12 @@ in
security.acme.certs =
let
reloads = map (useACMEHost: nameValuePair useACMEHost { reloadServices = [ "caddy.service" ]; }) acmeHosts;
certCfg = map (useACMEHost: nameValuePair useACMEHost {
group = mkDefault cfg.group;
reloadServices = [ "caddy.service" ];
}) acmeHosts;
in
listToAttrs reloads;
listToAttrs certCfg;
};
}

4
nixos/modules/services/web-servers/caddy/vhost-options.nix
View file

@ -40,9 +40,7 @@ in
<emphasis>Note that this option does not create any certificates, nor
does it add subdomains to existing ones – you will need to create them
manually using <xref linkend="opt-security.acme.certs"/>. Additionally,
you should probably add the <literal>caddy</literal> user to the
<literal>acme</literal> group to grant access to the certificates.</emphasis>
manually using <xref linkend="opt-security.acme.certs"/>.</emphasis>
'';
};