diff --git a/nixos/modules/security/acme.nix b/nixos/modules/security/acme.nix index 12ebc746f520..b50eeddfa40a 100644 --- a/nixos/modules/security/acme.nix +++ b/nixos/modules/security/acme.nix @@ -163,9 +163,8 @@ let [ "--dns" data.dnsProvider ] ++ optionals (!data.dnsPropagationCheck) [ "--dns.disable-cp" ] ++ optionals (data.dnsResolver != null) [ "--dns.resolvers" data.dnsResolver ] - ) else ( - [ "--http" "--http.webroot" data.webroot ] - ); + ) else if data.listenHTTP != null then [ "--http" "--http.port" data.listenHTTP ] + else [ "--http" "--http.webroot" data.webroot ]; commonOpts = [ "--accept-tos" # Checking the option is covered by the assertions @@ -321,6 +320,8 @@ let } fi ''); + } // optionalAttrs (data.listenHTTP != null && toInt (elemAt (splitString ":" data.listenHTTP) 1) < 1024) { + AmbientCapabilities = "CAP_NET_BIND_SERVICE"; }; # Working directory will be /tmp @@ -454,6 +455,17 @@ let ''; }; + listenHTTP = mkOption { + type = types.nullOr types.str; + default = null; + example = ":1360"; + description = '' + Interface and port to listen on to solve HTTP challenges + in the form [INTERFACE]:PORT. + If you use a port other than 80, you must proxy port 80 to this port. + ''; + }; + server = mkOption { type = types.nullOr types.str; default = null; @@ -783,6 +795,28 @@ in { `security.acme.certs.${cert}.webroot` are mutually exclusive. ''; } + { + assertion = data.webroot == null || data.listenHTTP == null; + message = '' + Options `security.acme.certs.${cert}.webroot` and + `security.acme.certs.${cert}.listenHTTP` are mutually exclusive. + ''; + } + { + assertion = data.listenHTTP == null || data.dnsProvider == null; + message = '' + Options `security.acme.certs.${cert}.listenHTTP` and + `security.acme.certs.${cert}.dnsProvider` are mutually exclusive. + ''; + } + { + assertion = data.dnsProvider != null || data.webroot != null || data.listenHTTP != null; + message = '' + One of `security.acme.certs.${cert}.dnsProvider`, + `security.acme.certs.${cert}.webroot`, or + `security.acme.certs.${cert}.listenHTTP` must be provided. + ''; + } ]) cfg.certs)); users.users.acme = { diff --git a/nixos/modules/services/misc/nitter.nix b/nixos/modules/services/misc/nitter.nix index 0c562343d85d..6a9eeb02095c 100644 --- a/nixos/modules/services/misc/nitter.nix +++ b/nixos/modules/services/misc/nitter.nix @@ -299,7 +299,7 @@ in systemd.services.nitter = { description = "Nitter (An alternative Twitter front-end)"; wantedBy = [ "multi-user.target" ]; - after = [ "syslog.target" "network.target" ]; + after = [ "network.target" ]; serviceConfig = { DynamicUser = true; StateDirectory = "nitter"; diff --git a/nixos/modules/services/network-filesystems/openafs/server.nix b/nixos/modules/services/network-filesystems/openafs/server.nix index c1bf83be77b9..9c974335defa 100644 --- a/nixos/modules/services/network-filesystems/openafs/server.nix +++ b/nixos/modules/services/network-filesystems/openafs/server.nix @@ -248,7 +248,7 @@ in { systemd.services = { openafs-server = { description = "OpenAFS server"; - after = [ "syslog.target" "network.target" ]; + after = [ "network.target" ]; wantedBy = [ "multi-user.target" ]; restartIfChanged = false; unitConfig.ConditionPathExists = [ diff --git a/nixos/modules/services/networking/adguardhome.nix b/nixos/modules/services/networking/adguardhome.nix index 4388ef2b7e57..03f9b9f9bad4 100644 --- a/nixos/modules/services/networking/adguardhome.nix +++ b/nixos/modules/services/networking/adguardhome.nix @@ -56,7 +56,7 @@ in config = mkIf cfg.enable { systemd.services.adguardhome = { description = "AdGuard Home: Network-level blocker"; - after = [ "syslog.target" "network.target" ]; + after = [ "network.target" ]; wantedBy = [ "multi-user.target" ]; unitConfig = { StartLimitIntervalSec = 5; diff --git a/nixos/modules/services/networking/eternal-terminal.nix b/nixos/modules/services/networking/eternal-terminal.nix index a2e5b30dc0f0..88b4cd90540f 100644 --- a/nixos/modules/services/networking/eternal-terminal.nix +++ b/nixos/modules/services/networking/eternal-terminal.nix @@ -67,7 +67,7 @@ in eternal-terminal = { description = "Eternal Terminal server."; wantedBy = [ "multi-user.target" ]; - after = [ "syslog.target" "network.target" ]; + after = [ "network.target" ]; serviceConfig = { Type = "forking"; ExecStart = "${pkgs.eternal-terminal}/bin/etserver --daemon --cfgfile=${pkgs.writeText "et.cfg" '' diff --git a/nixos/modules/services/web-apps/invidious.nix b/nixos/modules/services/web-apps/invidious.nix index 7fb826af5835..50370629e47c 100644 --- a/nixos/modules/services/web-apps/invidious.nix +++ b/nixos/modules/services/web-apps/invidious.nix @@ -11,7 +11,7 @@ let systemd.services.invidious = { description = "Invidious (An alternative YouTube front-end)"; wants = [ "network-online.target" ]; - after = [ "syslog.target" "network-online.target" ]; + after = [ "network-online.target" ]; wantedBy = [ "multi-user.target" ]; script = diff --git a/nixos/modules/services/web-apps/tt-rss.nix b/nixos/modules/services/web-apps/tt-rss.nix index 08356cee1dfe..9aa38ab25c9a 100644 --- a/nixos/modules/services/web-apps/tt-rss.nix +++ b/nixos/modules/services/web-apps/tt-rss.nix @@ -18,11 +18,11 @@ let tt-rss-config = let password = if (cfg.database.password != null) then - "${(escape ["'" "\\"] cfg.database.password)}" + "'${(escape ["'" "\\"] cfg.database.password)}'" else if (cfg.database.passwordFile != null) then - "file_get_contents('${cfg.database.passwordFile}'" + "file_get_contents('${cfg.database.passwordFile}')" else - "" + null ; in pkgs.writeText "config.php" ''