pyrox.dev
1lib:
2
3{
4 cert,
5 groups,
6 services,
7}:
8let
9 catSep = builtins.concatStringsSep;
10
11 svcUser = svc: svc.serviceConfig.User or "root";
12 svcGroups =
13 svc:
14 (lib.optional (svc.serviceConfig ? Group) svc.serviceConfig.Group)
15 ++ lib.toList (svc.serviceConfig.SupplementaryGroups or [ ]);
16in
17{
18 assertion = builtins.all (
19 svc:
20 svcUser svc == "root"
21 || builtins.elem (svcUser svc) groups.${cert.group}.members
22 || builtins.elem cert.group (svcGroups svc)
23 ) services;
24
25 message = "Certificate ${cert.domain} (group=${cert.group}) must be readable by service(s) ${
26 catSep ", " (
27 map (svc: "${svc.name} (user=${svcUser svc} groups=${catSep "," (svcGroups svc)})") services
28 )
29 }";
30}