DGNum/infrastructure
9
6
Fork 3
Code Issues 27 Pull requests 28 Projects 1 Releases Packages Wiki Activity Actions

fix(openbao): Correctly use UMask feature, tcp listener and genJqScript

Browse source
This commit is contained in:
Tom Hubrecht 2025-03-13 16:04:39 +01:00
parent f1e92c01c7
commit 19ec8d2bab
Signed by: thubrecht
SSH key fingerprint: SHA256:r+nK/SIcWlJ0zFZJGHtlAoRwq1Rm+WcKAm5ADYMoQPc
2 changed files with 6 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

4
modules/nixos/openbao/default.nix
View file

@ -81,7 +81,7 @@ in
) "consul.service";
restartIfChanged = false; # do not restart on "nixos-rebuild switch". It would seal the storage and disrupt the clients.
preStart = genJqSecretsReplacementSnippet (settingsFormat.generate "openbao-settings.json" cfg.settings) "/var/lib/openbao/config.json";
preStart = genJqSecretsReplacementSnippet cfg.settings "/var/lib/openbao/config.json";
startLimitIntervalSec = 60;
startLimitBurst = 3;
@ -98,7 +98,7 @@ in
);
ExecReload = "${getExe' pkgs.coreutils "kill"} -SIGHUP $MAINPID";
StateDirectory = "openbao";
UMask = "0700";
UMask = "0077";
AmbientCapabilities = "cap_ipc_lock";
KillSignal = "SIGINT";
LimitCORE = 0;