···

       
152
       
152
       
 
       
  copyKeys = concatStrings (mapAttrsToList (keyName: keyOptions: ''

     

       
153
       
153
       
 
       
    secret=$(cat "${keyOptions.keyFile}")

     

       
154
       
154
       
 
       
    dest="${stateDir}/private/${keyName}"

     

       
155
       
155
       
-
       
    echo "  secret: \"$secret\"" > "$dest"

     

       
156
       
156
       
-
       
    chown ${username}:${username} "$dest"

     

       
157
       
157
       
-
       
    chmod 0400 "$dest"

     

       
155
       
155
       
+
       
    install -m 0400 -o "${username}" -g "${username}" <(echo "  secret: \"$secret\"") "$dest"

     

       
158
       
156
       
 
       
  '') cfg.keys);

     

       
159
       
157
       
 
       


     

       
160
       
158
       
 
       


     
···

       
447
       
445
       
 
       
  dnssecTools = pkgs.bind.override { enablePython = true; };

     

       
448
       
446
       
 
       


     

       
449
       
447
       
 
       
  signZones = optionalString dnssec ''

     

       
450
       
450
       
-
       
    mkdir -p ${stateDir}/dnssec

     

       
451
       
451
       
-
       
    chown ${username}:${username} ${stateDir}/dnssec

     

       
452
       
452
       
-
       
    chmod 0600 ${stateDir}/dnssec

     

       
448
       
448
       
+
       
    install -m 0600 -o "${username}" -g "${username}" -d "${stateDir}/dnssec"

     

       
453
       
449
       
 
       


     

       
454
       
450
       
 
       
    ${concatStrings (mapAttrsToList signZone dnssecZones)}

     

       
455
       
451
       
 
       
  '';

     
···

       
940
       
936
       
 
       
        rm -Rf "${stateDir}/private/"

     

       
941
       
937
       
 
       
        rm -Rf "${stateDir}/tmp/"

     

       
942
       
938
       
 
       


     

       
943
       
943
       
-
       
        mkdir -m 0700 -p "${stateDir}/private"

     

       
944
       
944
       
-
       
        mkdir -m 0700 -p "${stateDir}/tmp"

     

       
945
       
945
       
-
       
        mkdir -m 0700 -p "${stateDir}/var"

     

       
939
       
939
       
+
       
        install -dm 0700 -o "${username}" -g "${username}" "${stateDir}/private"

     

       
940
       
940
       
+
       
        install -dm 0700 -o "${username}" -g "${username}" "${stateDir}/tmp"

     

       
941
       
941
       
+
       
        install -dm 0700 -o "${username}" -g "${username}" "${stateDir}/var"

     

       
946
       
942
       
 
       


     

       
947
       
943
       
 
       
        cat > "${stateDir}/don't touch anything in here" << EOF

     

       
948
       
944
       
 
       
        Everything in this directory except NSD's state in var and dnssec

     

       
949
       
945
       
 
       
        is automatically generated and will be purged and redeployed by

     

       
950
       
946
       
 
       
        the nsd.service pre-start script.

     

       
951
       
947
       
 
       
        EOF

     

       
952
       
952
       
-
       


     

       
953
       
953
       
-
       
        chown ${username}:${username} -R "${stateDir}/private"

     

       
954
       
954
       
-
       
        chown ${username}:${username} -R "${stateDir}/tmp"

     

       
955
       
955
       
-
       
        chown ${username}:${username} -R "${stateDir}/var"

     

       
956
       
948
       
 
       


     

       
957
       
949
       
 
       
        rm -rf "${stateDir}/zones"

     

       
958
       
950
       
 
       
        cp -rL "${nsdEnv}/zones" "${stateDir}/zones"