summaryrefslogtreecommitdiff
path: root/modules/certspotter.nix
diff options
context:
space:
mode:
Diffstat (limited to 'modules/certspotter.nix')
-rw-r--r--modules/certspotter.nix67
1 files changed, 0 insertions, 67 deletions
diff --git a/modules/certspotter.nix b/modules/certspotter.nix
deleted file mode 100644
index ff7ff7c2..00000000
--- a/modules/certspotter.nix
+++ /dev/null
@@ -1,67 +0,0 @@
1{ config, pkgs, lib, ... }:
2
3with lib;
4
5let
6 cfg = config.services.certspotter;
7
8 script = pkgs.writeShellApplication {
9 name = "certspotter-script";
10 runtimeInputs = with pkgs; [ coreutils ];
11 text = ''
12 mkdir -p "''${LOGS_DIRECTORY}"
13 env > "$(mktemp -p "''${LOGS_DIRECTORY}" "$(date -Iseconds).''${PUBKEY_HASH:-na}.XXXXXXXXXX.env")"
14 '';
15 };
16
17 startOptions = cfg.extraOptions
18 ++ optionals (cfg.logs != null) ["-logs" cfg.logs]
19 ++ ["-watchlist" (pkgs.writeText "watchlist" (concatStringsSep "\n" cfg.watchList))
20 "-script" "${script}/bin/certspotter-script"
21 ];
22
23 startScript = pkgs.writeShellApplication {
24 name = "certspotter-start";
25 runtimeInputs = [ pkgs.coreutils cfg.package ];
26 text = ''
27 rm -f "''${STATE_DIRECTORY}/lock"
28 exec -- certspotter -state_dir "''${STATE_DIRECTORY}" ${escapeShellArgs startOptions}
29 '';
30 };
31in {
32 options = {
33 services.certspotter = {
34 watchList = mkOption {
35 type = types.listOf types.str;
36 default = [];
37 };
38
39 logs = mkOption {
40 type = types.nullOr types.str;
41 default = null;
42 };
43
44 extraOptions = mkOption {
45 type = types.listOf types.str;
46 default = [ "-verbose" ];
47 };
48
49 package = mkPackageOption pkgs "certspotter" {};
50 };
51 };
52
53 config = mkIf (cfg.watchList != []) {
54 systemd.services.certspotter = {
55 serviceConfig = {
56 Type = "oneshot";
57 ExecStart = "${startScript}/bin/certspotter-start";
58 StateDirectory = "certspotter";
59 LogsDirectory = "certspotter";
60 DynamicUser = true;
61
62 CPUSchedulingPolicy = "idle";
63 IOSchedulingClass = "idle";
64 };
65 };
66 };
67}