Skip to content

Commit

Permalink
Revert "nixos/acme: Fix allowKeysForGroup not applying immediately"
Browse files Browse the repository at this point in the history
This reverts commit 5532065.

As far as I can tell setting RemainAfterExit=true here completely breaks
certificate renewal, which is really bad!

the sytemd timer will activate the service unit every OnCalendar=,
however with RemainAfterExit=true the service is already active! So the
timer doesn't rerun the service!

The commit also broke the actual tests, (As it broke activation too)
but this was fixed later in #76052
I wrongly assumed that PR fixed renewal too, which it didn't!

testing renewals is hard, as we need to sleep in tests.
  • Loading branch information
arianvp committed Apr 16, 2020
1 parent 86d71dd commit 5c1c642
Showing 1 changed file with 0 additions and 6 deletions.
6 changes: 0 additions & 6 deletions nixos/modules/security/acme.nix
Original file line number Diff line number Diff line change
Expand Up @@ -321,12 +321,6 @@ in
wantedBy = mkIf (!config.boot.isContainer) [ "multi-user.target" ];
serviceConfig = {
Type = "oneshot";
# With RemainAfterExit the service is considered active even
# after the main process having exited, which means when it
# gets changed, the activation phase restarts it, meaning
# the permissions of the StateDirectory get adjusted
# according to the specified group
RemainAfterExit = true;
User = data.user;
Group = data.group;
PrivateTmp = true;
Expand Down

0 comments on commit 5c1c642

Please sign in to comment.