@@ -1,4 +1,4 @@
1−{ config, lib, pkgs, ... }:
1+{ config, options, lib, pkgs, ... }:
22
33with lib;
44
@@ -11,7 +11,16 @@ in {
1111 dataDir = mkOption {
1212 default = "/var/lib/cfssl";
1313 type = types.path;
14− description = "Cfssl work directory.";
14+ description = ''
15+ The work directory for CFSSL.
16+
17+ <note><para>
18+ If left as the default value this directory will automatically be
19+ created before the CFSSL server starts, otherwise you are
20+ responsible for ensuring the directory exists with appropriate
21+ ownership and permissions.
22+ </para></note>
23+ '';
1524 };
1625
1726 address = mkOption {
@@ -153,7 +162,6 @@ in {
153162
154163 users.extraUsers.cfssl = {
155164 description = "cfssl user";
156− createHome = true;
157165 home = cfg.dataDir;
158166 group = "cfssl";
159167 uid = config.ids.uids.cfssl;
@@ -164,41 +172,45 @@ in {
164172 wantedBy = [ "multi-user.target" ];
165173 after = [ "network.target" ];
166174
167− serviceConfig = {
168− WorkingDirectory = cfg.dataDir;
169− StateDirectory = cfg.dataDir;
170− StateDirectoryMode = 700;
171− Restart = "always";
172− User = "cfssl";
173−
174− ExecStart = with cfg; let
175− opt = n: v: optionalString (v != null) ''-${n}="${v}"'';
176− in
177− lib.concatStringsSep " \\\n" [
178− "${pkgs.cfssl}/bin/cfssl serve"
179− (opt "address" address)
180− (opt "port" (toString port))
181− (opt "ca" ca)
182− (opt "ca-key" caKey)
183− (opt "ca-bundle" caBundle)
184− (opt "int-bundle" intBundle)
185− (opt "int-dir" intDir)
186− (opt "metadata" metadata)
187− (opt "remote" remote)
188− (opt "config" configFile)
189− (opt "responder" responder)
190− (opt "responder-key" responderKey)
191− (opt "tls-key" tlsKey)
192− (opt "tls-cert" tlsCert)
193− (opt "mutual-tls-ca" mutualTlsCa)
194− (opt "mutual-tls-cn" mutualTlsCn)
195− (opt "mutual-tls-client-key" mutualTlsClientKey)
196− (opt "mutual-tls-client-cert" mutualTlsClientCert)
197− (opt "tls-remote-ca" tlsRemoteCa)
198− (opt "db-config" dbConfig)
199− (opt "loglevel" (toString logLevel))
200− ];
201− };
175+ serviceConfig = lib.mkMerge [
176+ {
177+ WorkingDirectory = cfg.dataDir;
178+ Restart = "always";
179+ User = "cfssl";
180+
181+ ExecStart = with cfg; let
182+ opt = n: v: optionalString (v != null) ''-${n}="${v}"'';
183+ in
184+ lib.concatStringsSep " \\\n" [
185+ "${pkgs.cfssl}/bin/cfssl serve"
186+ (opt "address" address)
187+ (opt "port" (toString port))
188+ (opt "ca" ca)
189+ (opt "ca-key" caKey)
190+ (opt "ca-bundle" caBundle)
191+ (opt "int-bundle" intBundle)
192+ (opt "int-dir" intDir)
193+ (opt "metadata" metadata)
194+ (opt "remote" remote)
195+ (opt "config" configFile)
196+ (opt "responder" responder)
197+ (opt "responder-key" responderKey)
198+ (opt "tls-key" tlsKey)
199+ (opt "tls-cert" tlsCert)
200+ (opt "mutual-tls-ca" mutualTlsCa)
201+ (opt "mutual-tls-cn" mutualTlsCn)
202+ (opt "mutual-tls-client-key" mutualTlsClientKey)
203+ (opt "mutual-tls-client-cert" mutualTlsClientCert)
204+ (opt "tls-remote-ca" tlsRemoteCa)
205+ (opt "db-config" dbConfig)
206+ (opt "loglevel" (toString logLevel))
207+ ];
208+ }
209+ (mkIf (cfg.dataDir == options.services.cfssl.dataDir.default) {
210+ StateDirectory = baseNameOf cfg.dataDir;
211+ StateDirectoryMode = 700;
212+ })
213+ ];
202214 };
203215
204216 services.cfssl = {