nixos/gitea: make more secrets persistent #108676
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
ghost
self-requested a review
clerie
force-pushed
the
master
branch
2 times, most recently
from
dd6d4cf
to
3f9579d
Compare
clerie
changed the title
…AL_TOKEN to be persistent, like SECRET_KEY and LFS_JWT_SECRET do. Also renamed some vars belonging to SECRET_KEY and LFS_JWT_SECRET to get a consistent naming scheme over all secrets.
ghost
approved these changes
Jan 15, 2021
| @@ -349,7 +349,7 @@ in | |||
| { | |||
| DOMAIN = cfg.domain; | |||
| STATIC_ROOT_PATH = cfg.staticRootPath; | |||
| LFS_JWT_SECRET = "#jwtsecret#"; | |||
| LFS_JWT_SECRET = "#lfsjwtsecret#"; | |||
There was a problem hiding this comment.
Does this mean that if I don't change the secrets I would be using this well known secret? That sounds scary.
There was a problem hiding this comment.
Actually not. Have a look at the preStart in the systemd unit (line 470).
For each secret there is a dedicated file. If the file does not exist, a new secret will be generated and saved in this file. Afterwards every "magic string" will be replaced with the value saved in that file.
So as long as you don't mess around with these files you should be fine.
There was a problem hiding this comment.
Yeah, noticed that later, too but it is a bit complicated and can be easily miss understood.
This pull request was closed.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Motivation for this change
Added JWT_SECRET and INTERNAL_TOKEN to be persistent, like SECRET_KEY and LFS_JWT_SECRET do. Also renamed some vars belonging to SECRET_KEY and LFS_JWT_SECRET to get a consistent naming scheme over all secrets.
Things done
sandboxinnix.confon non-NixOS linux)nix-shell -p nixpkgs-review --run "nixpkgs-review wip"./result/bin/)nix path-info -Sbefore and after)