···

       
10
       
10
       
 
       
  certificateFile = lib.mkOption {

     

       
11
       
11
       
 
       
    type = with lib.types; nullOr path;

     

       
12
       
12
       
 
       
    description = ''

     

       
13
       
13
       
-
       
      Cert.pem file.

     

       
13
       
13
       
+
       
      Account certificate file, necessary to create, delete and manage tunnels. It can be obtained by running `cloudflared login`.

     

       
14
       
14
       
 
       


     

       
15
       
15
       
-
       
      See [Cert.pem](https://developers.cloudflare.com/cloudflare-one/connections/connect-apps/install-and-setup/tunnel-useful-terms/#certpem).

     

       
15
       
15
       
+
       
      Note that this is **necessary** for a fully declarative set up, as routes can not otherwise be created outside of the Cloudflare interface.

     

       
16
       
16
       
+
       


     

       
17
       
17
       
+
       
      See [Cert.pem](https://developers.cloudflare.com/cloudflare-one/connections/connect-apps/install-and-setup/tunnel-useful-terms/#certpem) for information about the file, and [Tunnel permissions](https://developers.cloudflare.com/cloudflare-one/connections/connect-networks/do-more-with-tunnels/local-management/tunnel-permissions/) for a comparison between the account certificate and the tunnel credentials file.

     

       
16
       
18
       
 
       
    '';

     

       
17
       
19
       
 
       
    default = null;

     

       
18
       
20
       
 
       
  };

     
···

       
301
       
303
       
 
       
  };

     

       
302
       
304
       
 
       


     

       
303
       
305
       
 
       
  config = lib.mkIf cfg.enable {

     

       
304
       
304
       
-
       
    assertions = lib.mapAttrsToList (name: tunnel: {

     

       
305
       
305
       
-
       
      assertion =

     

       
306
       
306
       
-
       
        tunnel.ingress == { } || (cfg.certificateFile != null || tunnel.certificateFile != null);

     

       
307
       
307
       
-
       
      message = "Cloudflare Tunnel ${name} has a declarative configuration, but no certificate file was defined.";

     

       
308
       
308
       
-
       
    }) cfg.tunnels;

     

       
309
       
309
       
-
       


     

       
310
       
306
       
 
       
    systemd.targets = lib.mapAttrs' (

     

       
311
       
307
       
 
       
      name: tunnel:

     

       
312
       
308
       
 
       
      lib.nameValuePair "cloudflared-tunnel-${name}" {