Mic92/stockholm
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

tv ejabberd: use LoadCredential

Browse Source
This commit is contained in:
tv 2021-12-25 11:41:20 +01:00
parent d4b12744d5
commit a1a0f11af4
2 changed files with 19 additions and 39 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
tv/3modules/ejabberd/config.nix
View File

@ -48,6 +48,9 @@ in /* yaml */ ''
- "::1/128" - "::1/128"
- "::FFFF:127.0.0.1/128" - "::FFFF:127.0.0.1/128"
certfiles:
- /tmp/credentials/certfile
hosts: ${toJSON config.hosts} hosts: ${toJSON config.hosts}
language: "en" language: "en"
@ -58,9 +61,8 @@ in /* yaml */ ''
ip: "::" ip: "::"
module: ejabberd_c2s module: ejabberd_c2s
shaper: c2s_shaper shaper: c2s_shaper
certfile: ${toJSON config.certfile.path}
ciphers: ${toJSON ciphers} ciphers: ${toJSON ciphers}
dhfile: ${toJSON config.dhfile.path} dhfile: /var/lib/ejabberd/dhfile
protocol_options: ${toJSON protocol_options} protocol_options: ${toJSON protocol_options}
starttls: true starttls: true
starttls_required: true starttls_required: true
@ -109,9 +111,8 @@ in /* yaml */ ''
mod_http_api: {} mod_http_api: {}
s2s_access: s2s s2s_access: s2s
s2s_certfile: ${toJSON config.s2s_certfile.path}
s2s_ciphers: ${toJSON ciphers} s2s_ciphers: ${toJSON ciphers}
s2s_dhfile: ${toJSON config.dhfile.path} s2s_dhfile: /var/lib/ejabberd/dhfile
s2s_protocol_options: ${toJSON protocol_options} s2s_protocol_options: ${toJSON protocol_options}
s2s_tls_compression: false s2s_tls_compression: false
s2s_use_starttls: required s2s_use_starttls: required

49
tv/3modules/ejabberd/default.nix
View File

@ -16,22 +16,8 @@ in {
options.tv.ejabberd = { options.tv.ejabberd = {
enable = mkEnableOption "tv.ejabberd"; enable = mkEnableOption "tv.ejabberd";
certfile = mkOption { certfile = mkOption {
type = types.secret-file; type = types.absolute-pathname;
default = { default = toString <secrets> + "/ejabberd.pem";
name = "ejabberd-certfile";
path = "${cfg.user.home}/ejabberd.pem";
owner = cfg.user;
source-path = toString <secrets> + "/ejabberd.pem";
};
};
dhfile = mkOption {
type = types.secret-file;
default = {
name = "ejabberd-dhfile";
path = "${cfg.user.home}/dhparams.pem";
owner = cfg.user;
source-path = "/dev/null";
};
}; };
hosts = mkOption { hosts = mkOption {
type = with types; listOf str; type = with types; listOf str;
@ -61,10 +47,6 @@ in {
config.krebs.users.tv.mail config.krebs.users.tv.mail
]; ];
}; };
s2s_certfile = mkOption {
type = types.secret-file;
default = cfg.certfile;
};
user = mkOption { user = mkOption {
type = types.user; type = types.user;
default = { default = {
@ -90,27 +72,24 @@ in {
}) })
]; ];
krebs.secret.files = { krebs.systemd.services.ejabberd = {};
ejabberd-certfile = cfg.certfile;
ejabberd-s2s_certfile = cfg.s2s_certfile;
};
systemd.services.ejabberd = { systemd.services.ejabberd = {
wantedBy = [ "multi-user.target" ]; wantedBy = [ "multi-user.target" ];
after = [ after = [ "network.target" ];
config.krebs.secret.files.ejabberd-certfile.service
config.krebs.secret.files.ejabberd-s2s_certfile.service
"network.target"
];
partOf = [
config.krebs.secret.files.ejabberd-certfile.service
config.krebs.secret.files.ejabberd-s2s_certfile.service
];
serviceConfig = { serviceConfig = {
ExecStartPre = "${gen-dhparam} ${cfg.dhfile.path}"; ExecStart = pkgs.writeDash "ejabberd" ''
ExecStart = "${cfg.pkgs.ejabberd}/bin/ejabberdctl foreground"; ${pkgs.coreutils}/bin/ln -s "$CREDENTIALS_DIRECTORY" /tmp/credentials
${gen-dhparam} /var/lib/ejabberd/dhfile
exec ${cfg.pkgs.ejabberd}/bin/ejabberdctl foreground
'';
LoadCredential = [
"certfile:${cfg.certfile}"
];
PermissionsStartOnly = true; PermissionsStartOnly = true;
PrivateTmp = true;
SyslogIdentifier = "ejabberd"; SyslogIdentifier = "ejabberd";
StateDirectory = "ejabberd";
User = cfg.user.name; User = cfg.user.name;
TimeoutStartSec = 60; TimeoutStartSec = 60;
}; };