diff options
| author | Arian van Putten <arian.vanputten@gmail.com> | 2020-04-15 23:10:31 +0200 |
|---|---|---|
| committer | Arian van Putten <arian.vanputten@gmail.com> | 2020-04-16 10:37:04 +0200 |
| commit | 5c1c642939c2e1009c07fa7db16a031c99738d87 (patch) | |
| tree | 61d6b84dda75695815140aa43c9ae8bdb020b80e | |
| parent | 86d71ddbed4263c435e9eba57a9663d24df00935 (diff) | |
Revert "nixos/acme: Fix allowKeysForGroup not applying immediately"
This reverts commit 5532065d0690645f0a813fed6e68163b0f4774d4.
As far as I can tell setting RemainAfterExit=true here completely breaks
certificate renewal, which is really bad!
the sytemd timer will activate the service unit every OnCalendar=,
however with RemainAfterExit=true the service is already active! So the
timer doesn't rerun the service!
The commit also broke the actual tests, (As it broke activation too)
but this was fixed later in https://github.com/NixOS/nixpkgs/pull/76052
I wrongly assumed that PR fixed renewal too, which it didn't!
testing renewals is hard, as we need to sleep in tests.
| -rw-r--r-- | nixos/modules/security/acme.nix | 6 |
1 files changed, 0 insertions, 6 deletions
diff --git a/nixos/modules/security/acme.nix b/nixos/modules/security/acme.nix index 4af373ef7df..d5fb9b58f2e 100644 --- a/nixos/modules/security/acme.nix +++ b/nixos/modules/security/acme.nix @@ -321,12 +321,6 @@ in wantedBy = mkIf (!config.boot.isContainer) [ "multi-user.target" ]; serviceConfig = { Type = "oneshot"; - # With RemainAfterExit the service is considered active even - # after the main process having exited, which means when it - # gets changed, the activation phase restarts it, meaning - # the permissions of the StateDirectory get adjusted - # according to the specified group - RemainAfterExit = true; User = data.user; Group = data.group; PrivateTmp = true; |