diff options
author | Ruben Maher <r@rkm.id.au> | 2016-10-30 12:12:01 +1030 |
---|---|---|
committer | Robert Helgesson <robert@rycee.net> | 2016-11-02 10:10:46 +0100 |
commit | 08d7fbb42d37994ad0a4f736f5585d6b584b4b87 (patch) | |
tree | 20141477e7e60289560eb08572bb26f8f5cd0c55 /nixos | |
parent | 4ae2a59aaafbf1986cda21be06ab4f8c83f5449d (diff) | |
download | nixlib-08d7fbb42d37994ad0a4f736f5585d6b584b4b87.tar nixlib-08d7fbb42d37994ad0a4f736f5585d6b584b4b87.tar.gz nixlib-08d7fbb42d37994ad0a4f736f5585d6b584b4b87.tar.bz2 nixlib-08d7fbb42d37994ad0a4f736f5585d6b584b4b87.tar.lz nixlib-08d7fbb42d37994ad0a4f736f5585d6b584b4b87.tar.xz nixlib-08d7fbb42d37994ad0a4f736f5585d6b584b4b87.tar.zst nixlib-08d7fbb42d37994ad0a4f736f5585d6b584b4b87.zip |
matrix-synapse: Allow keys to be generated
The matrix-synapse user has `createHome = true;` which runs before the `preStart` script, so the home directory will always exist and the block will never execute. Also don't include default path to keys in the configuration file, because synapse will choke if it tries to open them before they exist (even with `--generate-keys`).
Diffstat (limited to 'nixos')
-rw-r--r-- | nixos/modules/services/misc/matrix-synapse.nix | 30 |
1 files changed, 17 insertions, 13 deletions
diff --git a/nixos/modules/services/misc/matrix-synapse.nix b/nixos/modules/services/misc/matrix-synapse.nix index 4145f8fa957a..277fc9a39022 100644 --- a/nixos/modules/services/misc/matrix-synapse.nix +++ b/nixos/modules/services/misc/matrix-synapse.nix @@ -9,11 +9,15 @@ let mkListener = l: ''{port: ${toString l.port}, bind_address: "${l.bind_address}", type: ${l.type}, tls: ${fromBool l.tls}, x_forwarded: ${fromBool l.x_forwarded}, resources: [${concatStringsSep "," (map mkResource l.resources)}]}''; fromBool = x: if x then "true" else "false"; configFile = pkgs.writeText "homeserver.yaml" '' +${optionalString (cfg.tls_certificate_path != null) '' tls_certificate_path: "${cfg.tls_certificate_path}" +''} ${optionalString (cfg.tls_private_key_path != null) '' tls_private_key_path: "${cfg.tls_private_key_path}" ''} +${optionalString (cfg.tls_dh_params_path != null) '' tls_dh_params_path: "${cfg.tls_dh_params_path}" +''} no_tls: ${fromBool cfg.no_tls} ${optionalString (cfg.bind_port != null) '' bind_port: ${toString cfg.bind_port} @@ -146,8 +150,9 @@ in { ''; }; tls_certificate_path = mkOption { - type = types.str; - default = "/var/lib/matrix-synapse/homeserver.tls.crt"; + type = types.nullOr types.str; + default = null; + example = "/var/lib/matrix-synapse/homeserver.tls.crt"; description = '' PEM encoded X509 certificate for TLS. You can replace the self-signed certificate that synapse @@ -158,16 +163,17 @@ in { }; tls_private_key_path = mkOption { type = types.nullOr types.str; - default = "/var/lib/matrix-synapse/homeserver.tls.key"; - example = null; + default = null; + example = "/var/lib/matrix-synapse/homeserver.tls.key"; description = '' PEM encoded private key for TLS. Specify null if synapse is not speaking TLS directly. ''; }; tls_dh_params_path = mkOption { - type = types.str; - default = "/var/lib/matrix-synapse/homeserver.tls.dh"; + type = types.nullOr types.str; + default = null; + example = "/var/lib/matrix-synapse/homeserver.tls.dh"; description = '' PEM dh parameters for ephemeral keys ''; @@ -557,12 +563,10 @@ in { after = [ "network.target" ]; wantedBy = [ "multi-user.target" ]; preStart = '' - if ! test -e /var/lib/matrix-synapse; then - mkdir -p /var/lib/matrix-synapse - chmod 700 /var/lib/matrix-synapse - chown -R matrix-synapse:matrix-synapse /var/lib/matrix-synapse - ${cfg.package}/bin/homeserver --config-path ${configFile} --keys-directory /var/lib/matrix-synapse/ --generate-keys - fi + ${cfg.package}/bin/homeserver \ + --config-path ${configFile} \ + --keys-directory /var/lib/matrix-synapse \ + --generate-keys ''; serviceConfig = { Type = "simple"; @@ -570,7 +574,7 @@ in { Group = "matrix-synapse"; WorkingDirectory = "/var/lib/matrix-synapse"; PermissionsStartOnly = true; - ExecStart = "${cfg.package}/bin/homeserver --config-path ${configFile}"; + ExecStart = "${cfg.package}/bin/homeserver --config-path ${configFile} --keys-directory /var/lib/matrix-synapse"; }; }; }; |