foodogsquared/nixos-config
1
0
Fork 0
mirror of https://github.com/foo-dogsquared/nixos-config.git synced 2025-01-31 04:58:01 +00:00
Code Issues Actions 2 Packages Projects Releases Wiki Activity

hosts/plover: update Wezterm mux server config

Browse Source 
This should also fix the ACME certificate self-signed permissions error
since there is no `wezterm` group (or user). We're just using systemd's
dynamic user feature in our service.
This commit is contained in:
Gabriel Arazas 2023-07-27 13:36:05 +08:00
parent 9d75a4101f
commit 187b32e7bb
No known key found for this signature in database
GPG Key ID: ADE0C41DAB221FCC
2 changed files with 18 additions and 13 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
hosts/plover/config/wezterm/config.lua
View File

@ -1,7 +1,7 @@
return {
tls_servers = {
pem_private_key = "@CERT_DIR@/key.pem",
pem_cert = "@CERT_DIR@/cert.pem",
pem_ca = "@CERT_DIR@/fullchain.pem",
pem_private_key = os.getenv("CREDENTIALS_DIRECTORY") .. "/key.pem",
pem_cert = os.getenv("CREDENTIALS_DIRECTORY") .. "/cert.pem",
pem_ca = os.getenv("CREDENTIALS_DIRECTORY") .. "/fullchain.pem",
}
}

25
hosts/plover/modules/services/wezterm-mux-server.nix
View File

@ -3,21 +3,26 @@
# We're setting up Wezterm mux server with TLS domains.
let
weztermDomain = "mux.${config.networking.domain}";
configFile = pkgs.substituteAll {
src = ../../config/wezterm/config.lua;
CERT_DIR = config.security.acme.certs."${weztermDomain}".directory;
};
in
{
services.wezterm-mux-server = {
inherit configFile;
enable = true;
configFile = ../../config/wezterm/config.lua;
};
security.acme.certs."${weztermDomain}" = {
group = "wezterm";
postRun = ''
systemctl restart wezterm-mux-server.service
'';
systemd.services.wezterm-mux-server.serviceConfig = {
LoadCredential = let
certDir = config.security.acme.certs."${weztermDomain}".directory;
credentialCertPath = path: "${path}:${certDir}/${path}";
in
[
(credentialCertPath "key.pem")
(credentialCertPath "cert.pem")
(credentialCertPath "fullchain.pem")
];
};
security.acme.certs."${weztermDomain}".postRun = ''
systemctl restart wezterm-mux-server.service
'';
}