···

       
79
       
 
       
    };

     

       
80
       
 
       
  };

     

       
81
       
 
       


     

       
82
       
-
       
  config = mkIf cfg.enable {

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
83
       
 
       


     

       
84
       
 
       
    users.extraUsers.vault = {

     

       
85
       
 
       
      name = "vault";

     
···

       
96
       
 
       
      after = [ "network.target" ]

     

       
97
       
 
       
           ++ optional (config.services.consul.enable && cfg.storageBackend == "consul") "consul.service";

     

       
98
       
 
       


     

       
99
       
-
       
      preStart =

     

       
100
       
-
       
        optionalString (cfg.storageBackend == "file" || cfg.storageBackend == "file_transactional")

     

       
101
       
-
       
          (let

     

       
102
       
-
       
            matched = builtins.match ''.*path[ ]*=[ ]*"([^"]+)".*'' (toString cfg.storageConfig);

     

       
103
       
-
       
            path = if matched == null then

     

       
104
       
-
       
                     throw ''`storageBackend` "${cfg.storageBackend}" requires path in `storageConfig`''

     

       
105
       
-
       
                   else

     

       
106
       
-
       
                     head matched;

     

       
107
       
-
       
          in ''

     

       
108
       
-
       
            [ -d "${path}"] || install -d -m0700 -o vault -g vault "${path}"

     

       
109
       
-
       
          '') +

     

       
110
       
-
       
      ''

     

       
111
       
 
       
        # generate a self-signed certificate, you will have to set environment variable "VAULT_SKIP_VERIFY=1" in the client

     

       
112
       
 
       
        if [ ! -s ${cfg.tlsCertFile} -o ! -s ${cfg.tlsKeyFile} ]; then

     

       
113
       
 
       
          mkdir -p $(dirname ${cfg.tlsCertFile}) || true

     
···

       
138
       
 
       
        StartLimitInterval = "60s";

     

       
139
       
 
       
        StartLimitBurst = 3;

     

       
140
       
 
       
      };

     

       
0
       
 
       

     

       
0
       
 
       

     

       
141
       
 
       
    };

     

       
142
       
 
       
  };

     

       
143
       
 
       


     

···

       
79
       
 
       
    };

     

       
80
       
 
       
  };

     

       
81
       
 
       


     

       
82
       
+
       
  config = let

     

       
83
       
+
       
    localDir = if (cfg.storageBackend == "file" || cfg.storageBackend == "file_transactional") then

     

       
84
       
+
       
                 let

     

       
85
       
+
       
                   matched = builtins.match ''.*path[ ]*=[ ]*"([^"]+)".*'' (toString cfg.storageConfig);

     

       
86
       
+
       
                 in

     

       
87
       
+
       
                   if matched == null then

     

       
88
       
+
       
                     throw ''`storageBackend` "${cfg.storageBackend}" requires path in `storageConfig`''

     

       
89
       
+
       
                   else

     

       
90
       
+
       
                     head matched

     

       
91
       
+
       
               else

     

       
92
       
+
       
                 null;

     

       
93
       
+
       
  in mkIf cfg.enable {

     

       
94
       
 
       


     

       
95
       
 
       
    users.extraUsers.vault = {

     

       
96
       
 
       
      name = "vault";

     
···

       
107
       
 
       
      after = [ "network.target" ]

     

       
108
       
 
       
           ++ optional (config.services.consul.enable && cfg.storageBackend == "consul") "consul.service";

     

       
109
       
 
       


     

       
110
       
+
       
      preStart = optionalString (localDir != null) ''

     

       
111
       
+
       
        install -d -m0700 -o vault -g vault "${localDir}"

     

       
112
       
+
       
      '' + ''

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
113
       
 
       
        # generate a self-signed certificate, you will have to set environment variable "VAULT_SKIP_VERIFY=1" in the client

     

       
114
       
 
       
        if [ ! -s ${cfg.tlsCertFile} -o ! -s ${cfg.tlsKeyFile} ]; then

     

       
115
       
 
       
          mkdir -p $(dirname ${cfg.tlsCertFile}) || true

     
···

       
140
       
 
       
        StartLimitInterval = "60s";

     

       
141
       
 
       
        StartLimitBurst = 3;

     

       
142
       
 
       
      };

     

       
143
       
+
       


     

       
144
       
+
       
      unitConfig.RequiresMountsFor = optional (localDir != null) localDir;

     

       
145
       
 
       
    };

     

       
146
       
 
       
  };

     

       
147
       
 
       


     

···

       
1
       
-
       
{ stdenv, lib, buildGoPackage, fetchFromGitHub }:

     

       
2
       
 
       


     

       
3
       
 
       
let

     

       
4
       
 
       
  vaultBashCompletions = fetchFromGitHub {

     

···

       
1
       
+
       
{ stdenv, buildGoPackage, fetchFromGitHub }:

     

       
2
       
 
       


     

       
3
       
 
       
let

     

       
4
       
 
       
  vaultBashCompletions = fetchFromGitHub {