git.iko.soy/typeable/nixpkgs
on master help sign in
nixos/dendrite: always substitute environment variables in config

Before this patch, services.dendrite.environmentFile is used for secrets and environment variable substitution only happens when this option is used. systemd-247 provides a mechanism called LoadCredential for secrets and it is better than environment file. See the section of Environment= in the manual of systemd.exec for more information. This patch always substitute environment variables, which enables the usage of systemd LoadCredential.

commit1e32d28824ccdaf171f8044478bbb5ad8f042aaa authorlinj <linj.dev@outlook.com> dateMon 14 Mar 2022, 18:13 (5 years ago) parent3174707
1 file changed+5−8
compare with master
unifiedsplit
nixos/modules/services/misc/dendrite.nix+5−8
nixos/modules/services/misc/dendrite.nix+5−8
@@ -248,14 +248,11 @@ in
248248 RuntimeDirectory = "dendrite";
249249 RuntimeDirectoryMode = "0700";
250250 EnvironmentFile = lib.mkIf (cfg.environmentFile != null) cfg.environmentFile;
251− ExecStartPre =
252− if (cfg.environmentFile != null) then ''
253− ${pkgs.envsubst}/bin/envsubst \
254− -i ${configurationYaml} \
255− -o /run/dendrite/dendrite.yaml
256− '' else ''
257− ${pkgs.coreutils}/bin/cp ${configurationYaml} /run/dendrite/dendrite.yaml
258− '';
251+ ExecStartPre = ''
252+ ${pkgs.envsubst}/bin/envsubst \
253+ -i ${configurationYaml} \
254+ -o /run/dendrite/dendrite.yaml
255+ '';
259256 ExecStart = lib.strings.concatStringsSep " " ([
260257 "${pkgs.dendrite}/bin/dendrite-monolith-server"
261258 "--config /run/dendrite/dendrite.yaml"