BoomMicrophone/nixpkgs-suyu
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

nixos/taskserver: Move .trust out of .pki

Browse source 
This is clearly a server configuration option and has nothing to do with
certificate creation and signing, so let's move it away from the .pki
namespace.

Signed-off-by: aszlig <aszlig@redmoonstudios.org>
This commit is contained in:
aszlig 2016-04-11 12:47:39 +02:00
parent 3affead91b
commit 6df374910f
No known key found for this signature in database
GPG key ID: D0EBD0EC8C2DC961
1 changed files with 14 additions and 14 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

28
nixos/modules/services/misc/taskserver/default.nix
View file

@ -44,7 +44,7 @@ let
${mkConfLine "server.crl" cfg.pki.crl}
# certificates
${mkConfLine "trust" cfg.pki.trust}
${mkConfLine "trust" cfg.trust}
${if needToCreateCA then ''
ca.cert = ${cfg.dataDir}/keys/ca.cert
server.cert = ${cfg.dataDir}/keys/server.cert
@ -261,6 +261,19 @@ in {
'';
};
trust = mkOption {
type = types.enum [ "allow all" "strict" ];
default = "strict";
description = ''
Determines how client certificates are validated.
The value <literal>allow all</literal> performs no client
certificate validation. This is not recommended. The value
<literal>strict</literal> causes the client certificate to be
validated against a CA.
'';
};
pki = {
cert = mkOption {
type = types.nullOr types.path;
@ -292,19 +305,6 @@ in {
a configuration file reload before the next request is handled.
'';
};
trust = mkOption {
type = types.enum [ "allow all" "strict" ];
default = "strict";
description = ''
Determines how client certificates are validated.
The value <literal>allow all</literal> performs no client
certificate validation. This is not recommended. The value
<literal>strict</literal> causes the client certificate to be
validated against a CA.
'';
};
};
};
};