From f913f448bf07e41c18e538aaf1c0e35c9d0a71e9 Mon Sep 17 00:00:00 2001
From: Jean-Paul Calderone <exarkun@twistedmatrix.com>
Date: Mon, 1 Nov 2021 18:29:06 -0400
Subject: [PATCH] use a different state directory for the issuer's voucher
database
use the new one we're setting up on a new filesystem
---
nixos/modules/issuer.nix | 25 ++++++++++++++++++++-----
1 file changed, 20 insertions(+), 5 deletions(-)
diff --git a/nixos/modules/issuer.nix b/nixos/modules/issuer.nix
index e0d1f656..f5c85756 100644
--- a/nixos/modules/issuer.nix
+++ b/nixos/modules/issuer.nix
@@ -139,13 +139,28 @@ in {
# https://www.freedesktop.org/software/systemd/man/systemd.exec.html#RuntimeDirectory=
# "The specified directory names must be relative" ... this
# makes systemd create /var/lib/zkapissuer/ for us:
- serviceConfig.StateDirectory = "zkapissuer";
+ serviceConfig.StateDirectory = "zkapissuer-vouchers";
serviceConfig.StateDirectoryMode = "0750";
- # Bail if there is still an old (root-owned) DB file on this system.
- # If you hit this, and this /var/db/ file is indeed current, move it to
- # /var/lib/zkapissuer/vouchers.sqlite3 and chown it to zkapissuer:zkapissuer.
- unitConfig.AssertPathExists = "!/var/db/vouchers.sqlite3";
+ unitConfig.AssertPathExists = [
+ # Bail if there is still an old (root-owned) DB file on this system.
+ # If you hit this, and this /var/db/ file is indeed current, move it
+ # to /var/lib/zkapissuer/vouchers.sqlite3 and chown it to
+ # zkapissuer:zkapissuer.
+ "!/var/db/vouchers.sqlite3"
+
+ # Similarly, bail if the newer path you were just told to create --
+ # /var/lib/zkapissuer/vouchers.sqlite3 -- exists. It needs to be
+ # moved /var/lib/zkapissuer-vouchers where a dedicated filesystem has
+ # been created for it.
+ "!/var/lib/zkapissuer/vouchers.sqlite3"
+ ];
+
+ # Only start if the dedicated vouchers database filesystem is mounted so
+ # that we know we're going to find our vouchers database there (or that
+ # we will create it in the right place).
+ unitConfig.Requires = ["local-fs.target"];
+ unitConfig.After = ["local-fs.target"];
script =
let
--
GitLab