c4patino/nixpkgs
1
0
Fork 0
mirror of https://github.com/NixOS/nixpkgs.git synced 2026-07-06 17:13:24 -05:00
Code Issues Projects Releases Packages Wiki Activity

nixos/yggdrasil: Fix stray 0-byte /private-key file (#538065)

Browse source
This commit is contained in:
Florian Klink 2026-07-06 12:19:39 +00:00 • committed by GitHub
commit 8bb61a40df
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
1 changed files with 3 additions and 10 deletions
Download patch file Download diff file Expand all files Collapse all files

13
nixos/modules/services/networking/yggdrasil.nix
View file

@ -33,17 +33,11 @@ let
else else
null; null;
# Build base configuration with systemd credential path override
baseSettings = baseSettings =
cfg.settings cfg.settings
// ( // lib.optionalAttrs (effectiveKeyPath != null) {
if effectiveKeyPath != null then PrivateKeyPath = "/run/credentials/yggdrasil.service/private-key";
{ };
PrivateKeyPath = "/private-key";
}
else
{ }
);
# Remove null values that yggdrasil doesn't expect # Remove null values that yggdrasil doesn't expect
cleanSettings = lib.filterAttrs (n: v: v != null) baseSettings; cleanSettings = lib.filterAttrs (n: v: v != null) baseSettings;
@ -327,7 +321,6 @@ in
StateDirectory = "yggdrasil"; StateDirectory = "yggdrasil";
RuntimeDirectory = "yggdrasil"; RuntimeDirectory = "yggdrasil";
RuntimeDirectoryMode = "0750"; RuntimeDirectoryMode = "0750";
BindReadOnlyPaths = lib.optional (effectiveKeyPath != null) "%d/private-key:/private-key";
LoadCredential = lib.optional (effectiveKeyPath != null) "private-key:${effectiveKeyPath}"; LoadCredential = lib.optional (effectiveKeyPath != null) "private-key:${effectiveKeyPath}";
AmbientCapabilities = "CAP_NET_ADMIN CAP_NET_BIND_SERVICE"; AmbientCapabilities = "CAP_NET_ADMIN CAP_NET_BIND_SERVICE";