refactor(tazjin): Additional restricted-eval cleanup

Change-Id: I4baa94f65a16248023b5fb0e2dd305d6984566c8
Reviewed-on: https://cl.tvl.fyi/c/depot/+/5690
Reviewed-by: tazjin <tazjin@tvl.su>
Reviewed-by: sterni <sternenseemann@systemli.org>
Autosubmit: tazjin <tazjin@tvl.su>
Tested-by: BuildkiteCI
This commit is contained in:
Vincent Ambo 2022-05-26 16:39:56 +02:00 committed by clbot
parent 48dfefe40d
commit 565993f016
2 changed files with 7 additions and 22 deletions

View file

@ -10,25 +10,13 @@ let
extraConfig = "return 301 https://${to}$request_uri;";
};
mod = name: depot.path.origSrc + ("/ops/modules/" + name);
in
lib.fix (self: {
# Disable the current ACME module and use the old one from 19.09
# instead, until the various regressions have been sorted out.
# TODO(tazjin): Remove this once the new ACME module works.
disabledModules = [ "security/acme" ];
imports =
let
oldChannel = fetchTarball {
# NixOS 19.09 on 2020-10-04
url = "https://github.com/NixOS/nixpkgs-channels/archive/75f4ba05c63be3f147bcc2f7bd4ba1f029cedcb1.tar.gz";
sha256 = "157c64220lf825ll4c0cxsdwg7cxqdx4z559fdp7kpz0g6p8fhhr";
};
in
[
"${depot.path}/ops/modules/quassel.nix"
"${depot.path}/ops/modules/smtprelay.nix"
"${oldChannel}/nixos/modules/security/acme.nix"
];
imports = [
(mod "quassel.nix")
(mod "smtprelay.nix")
];
# camden is intended to boot unattended, despite having an encrypted
# root partition.
@ -201,11 +189,10 @@ lib.fix (self: {
# Provision a TLS certificate outside of nginx to avoid
# nixpkgs#38144
security.acme = {
# acceptTerms = true;
acceptTerms = true;
certs."tazj.in" = {
email = "mail@tazj.in";
user = "nginx";
group = "nginx";
webroot = "/var/lib/acme/acme-challenge";
extraDomains = {
@ -222,9 +209,7 @@ lib.fix (self: {
certs."quassel.tazj.in" = {
email = "mail@tazj.in";
webroot = "/var/lib/acme/challenge-quassel";
user = "nginx"; # required because of a bug in the ACME module
group = "quassel";
allowKeysForGroup = true;
};
};

View file

@ -12,7 +12,7 @@ let
in
lib.fix (self: {
imports = [
"${depot.path}/ops/modules/v4l2loopback.nix"
(depot.path.origSrc + "/ops/modules/v4l2loopback.nix")
];
boot = {