commit 2056c7e39548a1106b2f0101fdfd3fb8b7510479 · pyrox.dev/nixpkgs

+12 -20

nixos/modules/services/security/vault.nix

···

       7
        
         configFile = pkgs.writeText "vault.hcl" ''

     

       8
        
           listener "tcp" {

     

       9
        
             address = "${cfg.address}"

     

       10
       -
             tls_cert_file = "${cfg.tlsCertFile}"

     

       11
       -
             tls_key_file = "${cfg.tlsKeyFile}"

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       12
        
             ${cfg.listenerExtraConfig}

     

       13
        
           }

     

       14
        
           storage "${cfg.storageBackend}" {

     
···

       35
        
             };

     

       36
        
       

     

       37
        
             tlsCertFile = mkOption {

     

       38
       -
               type = types.str;

     

       39
       -
               default = "/etc/vault/cert.pem";

     

       40
        
               example = "/path/to/your/cert.pem";

     

       41
       -
               description = "TLS certificate file. A self-signed certificate will be generated if file not exists";

     

       42
        
             };

     

       43
        
       

     

       44
        
             tlsKeyFile = mkOption {

     

       45
       -
               type = types.str;

     

       46
       -
               default = "/etc/vault/key.pem";

     

       47
        
               example = "/path/to/your/key.pem";

     

       48
       -
               description = "TLS private key file. A self-signed certificate will be generated if file not exists";

     

       49
        
             };

     

       50
        
       

     

       51
        
             listenerExtraConfig = mkOption {

     
···

       109
        
       

     

       110
        
             preStart = optionalString (localDir != null) ''

     

       111
        
               install -d -m0700 -o vault -g vault "${localDir}"

     

       112
       -
             '' + ''

     

       113
       -
               # generate a self-signed certificate, you will have to set environment variable "VAULT_SKIP_VERIFY=1" in the client

     

       114
       -
               if [ ! -s ${cfg.tlsCertFile} -o ! -s ${cfg.tlsKeyFile} ]; then

     

       115
       -
                 mkdir -p $(dirname ${cfg.tlsCertFile}) || true

     

       116
       -
                 mkdir -p $(dirname ${cfg.tlsKeyFile }) || true

     

       117
       -
                 ${pkgs.openssl.bin}/bin/openssl req -x509 -newkey rsa:2048 -sha256 -nodes -days 99999 \

     

       118
       -
                   -subj /C=US/ST=NY/L=NYC/O=vault/CN=${cfg.address} \

     

       119
       -
                   -keyout ${cfg.tlsKeyFile} -out ${cfg.tlsCertFile}

     

       120
       -
       

     

       121
       -
                 chown root:vault ${cfg.tlsKeyFile} ${cfg.tlsCertFile}

     

       122
       -
                 chmod 440 ${cfg.tlsKeyFile} ${cfg.tlsCertFile}

     

       123
       -
               fi

     

       124
        
             '';

     

       125
        
       

     

       126
        
             serviceConfig = {

···

       7
        
         configFile = pkgs.writeText "vault.hcl" ''

     

       8
        
           listener "tcp" {

     

       9
        
             address = "${cfg.address}"

     

       10
       +
             ${if (cfg.tlsCertFile == null || cfg.tlsKeyFile == null) then ''

     

       11
       +
                 tls_disable = "true"

     

       12
       +
               '' else ''

     

       13
       +
                 tls_cert_file = "${cfg.tlsCertFile}"

     

       14
       +
                 tls_key_file = "${cfg.tlsKeyFile}"

     

       15
       +
               ''}

     

       16
        
             ${cfg.listenerExtraConfig}

     

       17
        
           }

     

       18
        
           storage "${cfg.storageBackend}" {

     
···

       39
        
             };

     

       40
        
       

     

       41
        
             tlsCertFile = mkOption {

     

       42
       +
               type = types.nullOr types.str;

     

       43
       +
               default = null;

     

       44
        
               example = "/path/to/your/cert.pem";

     

       45
       +
               description = "TLS certificate file. TLS will be disabled unless this option is set";

     

       46
        
             };

     

       47
        
       

     

       48
        
             tlsKeyFile = mkOption {

     

       49
       +
               type = types.nullOr types.str;

     

       50
       +
               default = null;

     

       51
        
               example = "/path/to/your/key.pem";

     

       52
       +
               description = "TLS private key file. TLS will be disabled unless this option is set";

     

       53
        
             };

     

       54
        
       

     

       55
        
             listenerExtraConfig = mkOption {

     
···

       113
        
       

     

       114
        
             preStart = optionalString (localDir != null) ''

     

       115
        
               install -d -m0700 -o vault -g vault "${localDir}"

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       116
        
             '';

     

       117
        
       

     

       118
        
             serviceConfig = {