@@ -69,11 +69,16 @@ in
6969 CERTIFICATE_KEY_FILE = "key.pem";
7070 };
7171 startLimitIntervalSec = 60;
72+ script = ''
73+ if [[ -v CREDENTIALS_DIRECTORY ]]; then
74+ cd "$CREDENTIALS_DIRECTORY"
75+ fi
76+ exec "${pkgs.pomerium}/bin/pomerium" -config "${cfgFile}"
77+ '';
7278
7379 serviceConfig = {
7480 DynamicUser = true;
7581 StateDirectory = [ "pomerium" ];
76− ExecStart = "${pkgs.pomerium}/bin/pomerium -config ${cfgFile}";
7782
7883 PrivateUsers = false; # breaks CAP_NET_BIND_SERVICE
7984 MemoryDenyWriteExecute = false; # breaks LuaJIT
@@ -99,7 +104,6 @@ in
99104 AmbientCapabilities = [ "CAP_NET_BIND_SERVICE" ];
100105 CapabilityBoundingSet = [ "CAP_NET_BIND_SERVICE" ];
101106
102− WorkingDirectory = mkIf (cfg.useACMEHost != null) "$CREDENTIALS_DIRECTORY";
103107 LoadCredential = optionals (cfg.useACMEHost != null) [
104108 "fullchain.pem:/var/lib/acme/${cfg.useACMEHost}/fullchain.pem"
105109 "key.pem:/var/lib/acme/${cfg.useACMEHost}/key.pem"
@@ -124,7 +128,7 @@ in
124128 Type = "oneshot";
125129 TimeoutSec = 60;
126130 ExecCondition = "/run/current-system/systemd/bin/systemctl -q is-active pomerium.service";
127− ExecStart = "/run/current-system/systemd/bin/systemctl restart pomerium.service";
131+ ExecStart = "/run/current-system/systemd/bin/systemctl --no-block restart pomerium.service";
128132 };
129133 };
130134 });