@@ -1,4 +1,4 @@
1−{ config, lib, pkgs, ... }:
1+{ config, options, lib, pkgs, ... }:
22
33with lib;
44
@@ -11,7 +11,16 @@ in {
1111 dataDir = mkOption {
1212 default = "/var/lib/cfssl";
1313 type = types.path;
14− description = "Cfssl work directory.";
14+ description = ''
15+ The work directory for CFSSL.
16+
17+ <note><para>
18+ If left as the default value this directory will automatically be
19+ created before the CFSSL server starts, otherwise you are
20+ responsible for ensuring the directory exists with appropriate
21+ ownership and permissions.
22+ </para></note>
23+ '';
1524 };
1625
1726 address = mkOption {
@@ -22,7 +31,7 @@ in {
2231
2332 port = mkOption {
2433 default = 8888;
25− type = types.ints.u16;
34+ type = types.port;
2635 description = "Port to bind.";
2736 };
2837
@@ -147,13 +156,12 @@ in {
147156 };
148157
149158 config = mkIf cfg.enable {
150− users.extraGroups.cfssl = {
159+ users.groups.cfssl = {
151160 gid = config.ids.gids.cfssl;
152161 };
153162
154− users.extraUsers.cfssl = {
163+ users.users.cfssl = {
155164 description = "cfssl user";
156− createHome = true;
157165 home = cfg.dataDir;
158166 group = "cfssl";
159167 uid = config.ids.uids.cfssl;
@@ -164,41 +172,46 @@ in {
164172 wantedBy = [ "multi-user.target" ];
165173 after = [ "network.target" ];
166174
167− serviceConfig = {
168− WorkingDirectory = cfg.dataDir;
169− StateDirectory = cfg.dataDir;
170− StateDirectoryMode = 700;
171− Restart = "always";
172− User = "cfssl";
173−
174− ExecStart = with cfg; let
175− opt = n: v: optionalString (v != null) ''-${n}="${v}"'';
176− in
177− lib.concatStringsSep " \\\n" [
178− "${pkgs.cfssl}/bin/cfssl serve"
179− (opt "address" address)
180− (opt "port" (toString port))
181− (opt "ca" ca)
182− (opt "ca-key" caKey)
183− (opt "ca-bundle" caBundle)
184− (opt "int-bundle" intBundle)
185− (opt "int-dir" intDir)
186− (opt "metadata" metadata)
187− (opt "remote" remote)
188− (opt "config" configFile)
189− (opt "responder" responder)
190− (opt "responder-key" responderKey)
191− (opt "tls-key" tlsKey)
192− (opt "tls-cert" tlsCert)
193− (opt "mutual-tls-ca" mutualTlsCa)
194− (opt "mutual-tls-cn" mutualTlsCn)
195− (opt "mutual-tls-client-key" mutualTlsClientKey)
196− (opt "mutual-tls-client-cert" mutualTlsClientCert)
197− (opt "tls-remote-ca" tlsRemoteCa)
198− (opt "db-config" dbConfig)
199− (opt "loglevel" (toString logLevel))
200− ];
201− };
175+ serviceConfig = lib.mkMerge [
176+ {
177+ WorkingDirectory = cfg.dataDir;
178+ Restart = "always";
179+ User = "cfssl";
180+ Group = "cfssl";
181+
182+ ExecStart = with cfg; let
183+ opt = n: v: optionalString (v != null) ''-${n}="${v}"'';
184+ in
185+ lib.concatStringsSep " \\\n" [
186+ "${pkgs.cfssl}/bin/cfssl serve"
187+ (opt "address" address)
188+ (opt "port" (toString port))
189+ (opt "ca" ca)
190+ (opt "ca-key" caKey)
191+ (opt "ca-bundle" caBundle)
192+ (opt "int-bundle" intBundle)
193+ (opt "int-dir" intDir)
194+ (opt "metadata" metadata)
195+ (opt "remote" remote)
196+ (opt "config" configFile)
197+ (opt "responder" responder)
198+ (opt "responder-key" responderKey)
199+ (opt "tls-key" tlsKey)
200+ (opt "tls-cert" tlsCert)
201+ (opt "mutual-tls-ca" mutualTlsCa)
202+ (opt "mutual-tls-cn" mutualTlsCn)
203+ (opt "mutual-tls-client-key" mutualTlsClientKey)
204+ (opt "mutual-tls-client-cert" mutualTlsClientCert)
205+ (opt "tls-remote-ca" tlsRemoteCa)
206+ (opt "db-config" dbConfig)
207+ (opt "loglevel" (toString logLevel))
208+ ];
209+ }
210+ (mkIf (cfg.dataDir == options.services.cfssl.dataDir.default) {
211+ StateDirectory = baseNameOf cfg.dataDir;
212+ StateDirectoryMode = 700;
213+ })
214+ ];
202215 };
203216
204217 services.cfssl = {