diff options
| author | Joe Mou <dev@mou.fo> | 2024-04-25 12:58:55 -0400 |
|---|---|---|
| committer | Joe Mou <dev@mou.fo> | 2024-04-26 16:30:07 -0400 |
| commit | 96b949393cfa64f8b44e16d269d9148696e44299 (patch) | |
| tree | 70cb58987e4ab071a830c02effe42226be88ce1f /hostnix/elmo/dyndns.nix | |
| parent | 3cb2738e79273af715380fadc6bb21584bc19c5a (diff) | |
elmo: Move secrets to /var/secrets
Clarifies that they are not managed by a distribution package.
Diffstat (limited to 'hostnix/elmo/dyndns.nix')
| -rw-r--r-- | hostnix/elmo/dyndns.nix | 13 |
1 files changed, 7 insertions, 6 deletions
diff --git a/hostnix/elmo/dyndns.nix b/hostnix/elmo/dyndns.nix index a59c665..bb396e2 100644 --- a/hostnix/elmo/dyndns.nix +++ b/hostnix/elmo/dyndns.nix @@ -5,7 +5,7 @@ # Based on https://nixos.org/manual/nixos/stable/index.html#module-security-acme-config-dns systemd.services.sig0-keygen = { unitConfig = { - ConditionPathExists = "!/var/lib/secrets/${config.networking.fqdn}.id"; + ConditionPathExists = "!/var/secrets/${config.networking.fqdn}.id"; }; serviceConfig = { Type = "oneshot"; @@ -13,9 +13,10 @@ path = [ pkgs.bind ]; scriptArgs = config.networking.fqdn; script = '' - mkdir -p /var/lib/secrets - chmod 755 /var/lib/secrets - cd /var/lib/secrets + mkdir -p /var/secrets + chmod 750 /var/secrets + chown :wheel /var/secrets + cd /var/secrets dnssec-keygen -a RSASHA512 -b 2048 -n HOST -T KEY $1. > $1.id ''; }; @@ -24,7 +25,7 @@ requires = [ "network-online.target" ]; after = [ "network-online.target" ]; unitConfig = { - AssertPathExists = "/var/lib/secrets/${config.networking.fqdn}.id"; + AssertPathExists = "/var/secrets/${config.networking.fqdn}.id"; # Defer errors for ~45min, throttle e-mails to ~hourly. StartLimitIntervalSec = "1hr"; StartLimitBurst = "45"; @@ -56,7 +57,7 @@ exit 0 fi - nsupdate -v -k /var/lib/secrets/`< /var/lib/secrets/$1.id`.private <<. + nsupdate -v -k /var/secrets/`< /var/secrets/$1.id`.private <<. update delete $RR. A update add $RR. 300 A $IP4 update delete $RR. AAAA |