VSinerva/nixos-conf
1
0
Fork 0
Code Activity Actions

Migrate cert-store to disko+impermanence

Browse source
This commit is contained in:
Vili Sinervä 2025-06-30 00:57:27 +03:00
parent 7e05e5ddc0
commit bab875ce72
Signed by: Vili Sinervä
SSH key fingerprint: SHA256:FladqYjaE4scJY3Hi+gnShZ6ygnTJgixy0I6BAoHyos
15 changed files with 134 additions and 227 deletions
Download patch file Download diff file Expand all files Collapse all files

12
servers/acme-cert-store.nix
View file

@ -8,8 +8,8 @@ let
${pkgs.sops}/bin/sops -d --extract '["cert-fullchain"]' --output old-fullchain secrets/cert.yaml
${pkgs.sops}/bin/sops -d --extract '["cert-key"]' --output old-key secrets/cert.yaml
cp ${config.users.users."cert-store".home}/acme/-.vsinerva.fi/fullchain.pem ./new-fullchain
cp ${config.users.users."cert-store".home}/acme/-.vsinerva.fi/key.pem ./new-key
cp ${config.users.users."cert-store".home}/-.vsinerva.fi/fullchain.pem ./new-fullchain
cp ${config.users.users."cert-store".home}/-.vsinerva.fi/key.pem ./new-key
if ${pkgs.diffutils}/bin/cmp new-fullchain old-fullchain; then
echo "Old and new fullchain are the same, skipping!"
@ -45,6 +45,14 @@ in
};
};
environment.persistence."/persist".directories = [
{
directory = "/home/cert-store";
user = "cert-store";
group = "users";
mode = "u=rwx,g=,o=";
}
];
users.users."cert-store" = {
isNormalUser = true;
openssh.authorizedKeys.keys = config.users.users.root.openssh.authorizedKeys.keys ++ [