zhaofengli/colmena
1
1
Fork 0
mirror of https://github.com/zhaofengli/colmena.git synced 2024-09-11 17:56:46 +03:00
Code Issues Projects Releases Wiki Activity

Merge pull request #150 from sumnerevans/doc-keys-group

Browse Source
This commit is contained in:
Zhaofeng Li 2023-04-28 21:03:00 -06:00 committed by GitHub
commit be837ee341
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 9 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
manual/src/features/keys.md
View File

@ -34,6 +34,15 @@ To upload your secrets without performing a full deployment, use `colmena upload
For each secret file deployed using `deployment.keys`, a systemd service with the name of `${name}-key.service` is created (`acme-credentials.secret-key.service` for the example above).
This unit is only active when the corresponding file is present, allowing you to set up dependencies for services requiring secret files to function.
## Key Permissions
The `/run/keys` directory is owned by the `keys` group. If you are using a
systemd service running as a non-root user, you will likely need to add:
```
SupplementaryGroups = [ "keys" ];
```
to your service configuration.
## Flakes
If you are using flakes, Nix will copy the entire flake (everything tracked by git) into the Nix store during evaluation.