commit 6c800013bfe84e4f6a732337d7f88a161884cfcc · pyrox.dev/nixpkgs

+15 -15
nixos/modules/services/networking/strongswan-swanctl/module.nix
···

       43
       43
        
       

     

       44
       44
        
           # The swanctl command complains when the following directories don't exist:

     

       45
       45
        
           # See: https://wiki.strongswan.org/projects/strongswan/wiki/Swanctldirectory

     

       46
       46
       -
           system.activationScripts.strongswan-swanctl-etc = stringAfter ["etc"] ''

     

       47
       47
       -
             mkdir -p '/etc/swanctl/x509'     # Trusted X.509 end entity certificates

     

       48
       48
       -
             mkdir -p '/etc/swanctl/x509ca'   # Trusted X.509 Certificate Authority certificates

     

       49
       49
       -
             mkdir -p '/etc/swanctl/x509ocsp'

     

       50
       50
       -
             mkdir -p '/etc/swanctl/x509aa'   # Trusted X.509 Attribute Authority certificates

     

       51
       51
       -
             mkdir -p '/etc/swanctl/x509ac'   # Attribute Certificates

     

       52
       52
       -
             mkdir -p '/etc/swanctl/x509crl'  # Certificate Revocation Lists

     

       53
       53
       -
             mkdir -p '/etc/swanctl/pubkey'   # Raw public keys

     

       54
       54
       -
             mkdir -p '/etc/swanctl/private'  # Private keys in any format

     

       55
       55
       -
             mkdir -p '/etc/swanctl/rsa'      # PKCS#1 encoded RSA private keys

     

       56
       56
       -
             mkdir -p '/etc/swanctl/ecdsa'    # Plain ECDSA private keys

     

       57
       57
       -
             mkdir -p '/etc/swanctl/bliss'

     

       58
       58
       -
             mkdir -p '/etc/swanctl/pkcs8'    # PKCS#8 encoded private keys of any type

     

       59
       59
       -
             mkdir -p '/etc/swanctl/pkcs12'   # PKCS#12 containers

     

       60
       60
       -
           '';

     

       46
       46
       +
           systemd.tmpfiles.rules = [

     

       47
       47
       +
             "d /etc/swanctl/x509 -"     # Trusted X.509 end entity certificates

     

       48
       48
       +
             "d /etc/swanctl/x509ca -"   # Trusted X.509 Certificate Authority certificates

     

       49
       49
       +
             "d /etc/swanctl/x509ocsp -"

     

       50
       50
       +
             "d /etc/swanctl/x509aa -"   # Trusted X.509 Attribute Authority certificates

     

       51
       51
       +
             "d /etc/swanctl/x509ac -"   # Attribute Certificates

     

       52
       52
       +
             "d /etc/swanctl/x509crl -"  # Certificate Revocation Lists

     

       53
       53
       +
             "d /etc/swanctl/pubkey -"   # Raw public keys

     

       54
       54
       +
             "d /etc/swanctl/private -"  # Private keys in any format

     

       55
       55
       +
             "d /etc/swanctl/rsa -"      # PKCS#1 encoded RSA private keys

     

       56
       56
       +
             "d /etc/swanctl/ecdsa -"    # Plain ECDSA private keys

     

       57
       57
       +
             "d /etc/swanctl/bliss -"

     

       58
       58
       +
             "d /etc/swanctl/pkcs8 -"    # PKCS#8 encoded private keys of any type

     

       59
       59
       +
             "d /etc/swanctl/pkcs12 -"   # PKCS#12 containers

     

       60
       60
       +
           ];

     

       61
       61
        
       

     

       62
       62
        
           systemd.services.strongswan-swanctl = {

     

       63
       63
        
             description = "strongSwan IPsec IKEv1/IKEv2 daemon using swanctl";