mirror of
https://github.com/NixOS/nixpkgs.git
synced 2025-11-09 16:18:34 +01:00
18dc3dd0b9
Currently the module's `DyanmicUser` does not exist at build time and therefore this module's secrets file can't be assigned appropriate (e.g. 0400) permissions without additional configuration. This change uses `LoadCredential` to read the secrets file with elevated privileges and place then into the service-specific credentials directory, where the dynamic user can access them. This will allow using standard approaches to nix secrets (such as sops, agenix), which by default provide an out-of-store `0400 root:root` file. Fixes https://github.com/NixOS/nixpkgs/issues/408780
34 lines
914 B
Nix
34 lines
914 B
Nix
{ lib, ... }:
|
|
|
|
{
|
|
name = "zwave-js";
|
|
meta.maintainers = with lib.maintainers; [ graham33 ];
|
|
|
|
nodes = {
|
|
machine = {
|
|
# show that 0400 secrets can be used by the DynamicUser; ideally
|
|
# this would be an out-of-store file, e.g. /run/secrets/jwavejs/secrets.json
|
|
environment.etc."zwavejs/secrets.json" = {
|
|
mode = "0400";
|
|
text = builtins.toJSON {
|
|
securityKeys.S0_Legacy = "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA";
|
|
};
|
|
};
|
|
services.zwave-js = {
|
|
enable = true;
|
|
serialPort = "/dev/null";
|
|
extraFlags = [ "--mock-driver" ];
|
|
secretsConfigFile = "/etc/zwavejs/secrets.json";
|
|
};
|
|
};
|
|
};
|
|
|
|
testScript = ''
|
|
start_all()
|
|
|
|
machine.wait_for_unit("zwave-js.service")
|
|
machine.wait_for_open_port(3000)
|
|
machine.wait_until_succeeds("journalctl --since -1m --unit zwave-js --grep 'ZwaveJS server listening'")
|
|
'';
|
|
}
|