···299299 # Ensure essential files exist.
300300 if [[ ! -f ${cfg.dataDir}/configs/znc.conf ]]; then
301301 echo "No znc.conf file found in ${cfg.dataDir}. Creating one now."
302302- cp --no-clobber ${cfg.configFile} ${cfg.dataDir}/configs/znc.conf
302302+ cp --no-preserve=ownership --no-clobber ${cfg.configFile} ${cfg.dataDir}/configs/znc.conf
303303 chmod u+rw ${cfg.dataDir}/configs/znc.conf
304304- chown ${cfg.user} ${cfg.dataDir}/configs/znc.conf
305304 fi
306305307306 if [[ ! -f ${cfg.dataDir}/znc.pem ]]; then
+159-123
nixos/modules/services/web-apps/keycloak.nix
···54545555 frontendUrl = lib.mkOption {
5656 type = lib.types.str;
5757+ apply = x: if lib.hasSuffix "/" x then x else x + "/";
5758 example = "keycloak.example.com/auth";
5859 description = ''
5960 The public URL used as base for all frontend requests. Should
···8485 '';
8586 };
86878787- certificatePrivateKeyBundle = lib.mkOption {
8888+ sslCertificate = lib.mkOption {
8889 type = lib.types.nullOr lib.types.path;
8990 default = null;
9091 example = "/run/keys/ssl_cert";
9192 description = ''
9292- The path to a PEM formatted bundle of the private key and
9393- certificate to use for TLS connections.
9393+ The path to a PEM formatted certificate to use for TLS/SSL
9494+ connections.
94959596 This should be a string, not a Nix path, since Nix paths are
9697 copied into the world-readable Nix store.
9798 '';
9899 };
99100100100- databaseType = lib.mkOption {
101101- type = lib.types.enum [ "mysql" "postgresql" ];
102102- default = "postgresql";
103103- example = "mysql";
101101+ sslCertificateKey = lib.mkOption {
102102+ type = lib.types.nullOr lib.types.path;
103103+ default = null;
104104+ example = "/run/keys/ssl_key";
104105 description = ''
105105- The type of database Keycloak should connect to.
106106- '';
107107- };
106106+ The path to a PEM formatted private key to use for TLS/SSL
107107+ connections.
108108109109- databaseHost = lib.mkOption {
110110- type = lib.types.str;
111111- default = "localhost";
112112- description = ''
113113- Hostname of the database to connect to.
109109+ This should be a string, not a Nix path, since Nix paths are
110110+ copied into the world-readable Nix store.
114111 '';
115112 };
116113117117- databasePort =
118118- let
119119- dbPorts = {
120120- postgresql = 5432;
121121- mysql = 3306;
122122- };
123123- in
124124- lib.mkOption {
125125- type = lib.types.port;
126126- default = dbPorts.${cfg.databaseType};
127127- description = ''
128128- Port of the database to connect to.
129129- '';
130130- };
114114+ database = {
115115+ type = lib.mkOption {
116116+ type = lib.types.enum [ "mysql" "postgresql" ];
117117+ default = "postgresql";
118118+ example = "mysql";
119119+ description = ''
120120+ The type of database Keycloak should connect to.
121121+ '';
122122+ };
131123132132- databaseUseSSL = lib.mkOption {
133133- type = lib.types.bool;
134134- default = cfg.databaseHost != "localhost";
135135- description = ''
136136- Whether the database connection should be secured by SSL /
137137- TLS.
138138- '';
139139- };
124124+ host = lib.mkOption {
125125+ type = lib.types.str;
126126+ default = "localhost";
127127+ description = ''
128128+ Hostname of the database to connect to.
129129+ '';
130130+ };
140131141141- databaseCaCert = lib.mkOption {
142142- type = lib.types.nullOr lib.types.path;
143143- default = null;
144144- description = ''
145145- The SSL / TLS CA certificate that verifies the identity of the
146146- database server.
132132+ port =
133133+ let
134134+ dbPorts = {
135135+ postgresql = 5432;
136136+ mysql = 3306;
137137+ };
138138+ in
139139+ lib.mkOption {
140140+ type = lib.types.port;
141141+ default = dbPorts.${cfg.database.type};
142142+ description = ''
143143+ Port of the database to connect to.
144144+ '';
145145+ };
147146148148- Required when PostgreSQL is used and SSL is turned on.
147147+ useSSL = lib.mkOption {
148148+ type = lib.types.bool;
149149+ default = cfg.database.host != "localhost";
150150+ description = ''
151151+ Whether the database connection should be secured by SSL /
152152+ TLS.
153153+ '';
154154+ };
149155150150- For MySQL, if left at <literal>null</literal>, the default
151151- Java keystore is used, which should suffice if the server
152152- certificate is issued by an official CA.
153153- '';
154154- };
156156+ caCert = lib.mkOption {
157157+ type = lib.types.nullOr lib.types.path;
158158+ default = null;
159159+ description = ''
160160+ The SSL / TLS CA certificate that verifies the identity of the
161161+ database server.
155162156156- databaseCreateLocally = lib.mkOption {
157157- type = lib.types.bool;
158158- default = true;
159159- description = ''
160160- Whether a database should be automatically created on the
161161- local host. Set this to false if you plan on provisioning a
162162- local database yourself. This has no effect if
163163- services.keycloak.databaseHost is customized.
164164- '';
165165- };
163163+ Required when PostgreSQL is used and SSL is turned on.
166164167167- databaseUsername = lib.mkOption {
168168- type = lib.types.str;
169169- default = "keycloak";
170170- description = ''
171171- Username to use when connecting to an external or manually
172172- provisioned database; has no effect when a local database is
173173- automatically provisioned.
165165+ For MySQL, if left at <literal>null</literal>, the default
166166+ Java keystore is used, which should suffice if the server
167167+ certificate is issued by an official CA.
168168+ '';
169169+ };
174170175175- To use this with a local database, set <xref
176176- linkend="opt-services.keycloak.databaseCreateLocally" /> to
177177- <literal>false</literal> and create the database and user
178178- manually. The database should be called
179179- <literal>keycloak</literal>.
180180- '';
181181- };
171171+ createLocally = lib.mkOption {
172172+ type = lib.types.bool;
173173+ default = true;
174174+ description = ''
175175+ Whether a database should be automatically created on the
176176+ local host. Set this to false if you plan on provisioning a
177177+ local database yourself. This has no effect if
178178+ services.keycloak.database.host is customized.
179179+ '';
180180+ };
182181183183- databasePasswordFile = lib.mkOption {
184184- type = lib.types.path;
185185- example = "/run/keys/db_password";
186186- description = ''
187187- File containing the database password.
182182+ username = lib.mkOption {
183183+ type = lib.types.str;
184184+ default = "keycloak";
185185+ description = ''
186186+ Username to use when connecting to an external or manually
187187+ provisioned database; has no effect when a local database is
188188+ automatically provisioned.
188189189189- This should be a string, not a Nix path, since Nix paths are
190190- copied into the world-readable Nix store.
191191- '';
190190+ To use this with a local database, set <xref
191191+ linkend="opt-services.keycloak.database.createLocally" /> to
192192+ <literal>false</literal> and create the database and user
193193+ manually. The database should be called
194194+ <literal>keycloak</literal>.
195195+ '';
196196+ };
197197+198198+ passwordFile = lib.mkOption {
199199+ type = lib.types.path;
200200+ example = "/run/keys/db_password";
201201+ description = ''
202202+ File containing the database password.
203203+204204+ This should be a string, not a Nix path, since Nix paths are
205205+ copied into the world-readable Nix store.
206206+ '';
207207+ };
192208 };
193209194210 package = lib.mkOption {
···261277 config =
262278 let
263279 # We only want to create a database if we're actually going to connect to it.
264264- databaseActuallyCreateLocally = cfg.databaseCreateLocally && cfg.databaseHost == "localhost";
265265- createLocalPostgreSQL = databaseActuallyCreateLocally && cfg.databaseType == "postgresql";
266266- createLocalMySQL = databaseActuallyCreateLocally && cfg.databaseType == "mysql";
280280+ databaseActuallyCreateLocally = cfg.database.createLocally && cfg.database.host == "localhost";
281281+ createLocalPostgreSQL = databaseActuallyCreateLocally && cfg.database.type == "postgresql";
282282+ createLocalMySQL = databaseActuallyCreateLocally && cfg.database.type == "mysql";
267283268284 mySqlCaKeystore = pkgs.runCommandNoCC "mysql-ca-keystore" {} ''
269269- ${pkgs.jre}/bin/keytool -importcert -trustcacerts -alias MySQLCACert -file ${cfg.databaseCaCert} -keystore $out -storepass notsosecretpassword -noprompt
285285+ ${pkgs.jre}/bin/keytool -importcert -trustcacerts -alias MySQLCACert -file ${cfg.database.caCert} -keystore $out -storepass notsosecretpassword -noprompt
270286 '';
271287272288 keycloakConfig' = builtins.foldl' lib.recursiveUpdate {
···282298 };
283299 "subsystem=datasources"."data-source=KeycloakDS" = {
284300 max-pool-size = "20";
285285- user-name = if databaseActuallyCreateLocally then "keycloak" else cfg.databaseUsername;
301301+ user-name = if databaseActuallyCreateLocally then "keycloak" else cfg.database.username;
286302 password = "@db-password@";
287303 };
288304 } [
289289- (lib.optionalAttrs (cfg.databaseType == "postgresql") {
305305+ (lib.optionalAttrs (cfg.database.type == "postgresql") {
290306 "subsystem=datasources" = {
291307 "jdbc-driver=postgresql" = {
292308 driver-module-name = "org.postgresql";
···294310 driver-xa-datasource-class-name = "org.postgresql.xa.PGXADataSource";
295311 };
296312 "data-source=KeycloakDS" = {
297297- connection-url = "jdbc:postgresql://${cfg.databaseHost}:${builtins.toString cfg.databasePort}/keycloak";
313313+ connection-url = "jdbc:postgresql://${cfg.database.host}:${builtins.toString cfg.database.port}/keycloak";
298314 driver-name = "postgresql";
299299- "connection-properties=ssl".value = lib.boolToString cfg.databaseUseSSL;
300300- } // (lib.optionalAttrs (cfg.databaseCaCert != null) {
301301- "connection-properties=sslrootcert".value = cfg.databaseCaCert;
315315+ "connection-properties=ssl".value = lib.boolToString cfg.database.useSSL;
316316+ } // (lib.optionalAttrs (cfg.database.caCert != null) {
317317+ "connection-properties=sslrootcert".value = cfg.database.caCert;
302318 "connection-properties=sslmode".value = "verify-ca";
303319 });
304320 };
305321 })
306306- (lib.optionalAttrs (cfg.databaseType == "mysql") {
322322+ (lib.optionalAttrs (cfg.database.type == "mysql") {
307323 "subsystem=datasources" = {
308324 "jdbc-driver=mysql" = {
309325 driver-module-name = "com.mysql";
···311327 driver-class-name = "com.mysql.jdbc.Driver";
312328 };
313329 "data-source=KeycloakDS" = {
314314- connection-url = "jdbc:mysql://${cfg.databaseHost}:${builtins.toString cfg.databasePort}/keycloak";
330330+ connection-url = "jdbc:mysql://${cfg.database.host}:${builtins.toString cfg.database.port}/keycloak";
315331 driver-name = "mysql";
316316- "connection-properties=useSSL".value = lib.boolToString cfg.databaseUseSSL;
317317- "connection-properties=requireSSL".value = lib.boolToString cfg.databaseUseSSL;
318318- "connection-properties=verifyServerCertificate".value = lib.boolToString cfg.databaseUseSSL;
332332+ "connection-properties=useSSL".value = lib.boolToString cfg.database.useSSL;
333333+ "connection-properties=requireSSL".value = lib.boolToString cfg.database.useSSL;
334334+ "connection-properties=verifyServerCertificate".value = lib.boolToString cfg.database.useSSL;
319335 "connection-properties=characterEncoding".value = "UTF-8";
320336 valid-connection-checker-class-name = "org.jboss.jca.adapters.jdbc.extensions.mysql.MySQLValidConnectionChecker";
321337 validate-on-match = true;
322338 exception-sorter-class-name = "org.jboss.jca.adapters.jdbc.extensions.mysql.MySQLExceptionSorter";
323323- } // (lib.optionalAttrs (cfg.databaseCaCert != null) {
339339+ } // (lib.optionalAttrs (cfg.database.caCert != null) {
324340 "connection-properties=trustCertificateKeyStoreUrl".value = "file:${mySqlCaKeystore}";
325341 "connection-properties=trustCertificateKeyStorePassword".value = "notsosecretpassword";
326342 });
327343 };
328344 })
329329- (lib.optionalAttrs (cfg.certificatePrivateKeyBundle != null) {
345345+ (lib.optionalAttrs (cfg.sslCertificate != null && cfg.sslCertificateKey != null) {
330346 "socket-binding-group=standard-sockets"."socket-binding=https".port = cfg.httpsPort;
331347 "core-service=management"."security-realm=UndertowRealm"."server-identity=ssl" = {
332348 keystore-path = "/run/keycloak/ssl/certificate_private_key_bundle.p12";
···537553538554 jbossCliScript = pkgs.writeText "jboss-cli-script" (mkJbossScript keycloakConfig');
539555540540- keycloakConfig = pkgs.runCommandNoCC "keycloak-config" {} ''
556556+ keycloakConfig = pkgs.runCommandNoCC "keycloak-config" {
557557+ nativeBuildInputs = [ cfg.package ];
558558+ } ''
541559 export JBOSS_BASE_DIR="$(pwd -P)";
542560 export JBOSS_MODULEPATH="${cfg.package}/modules";
543561 export JBOSS_LOG_DIR="$JBOSS_BASE_DIR/log";
···547565548566 mkdir -p {deployments,ssl}
549567550550- "${cfg.package}/bin/standalone.sh"&
568568+ standalone.sh&
551569552570 attempt=1
553571 max_attempts=30
554554- while ! ${cfg.package}/bin/jboss-cli.sh --connect ':read-attribute(name=server-state)'; do
572572+ while ! jboss-cli.sh --connect ':read-attribute(name=server-state)'; do
555573 if [[ "$attempt" == "$max_attempts" ]]; then
556574 echo "ERROR: Could not connect to Keycloak after $attempt attempts! Failing.." >&2
557575 exit 1
···561579 (( attempt++ ))
562580 done
563581564564- ${cfg.package}/bin/jboss-cli.sh --connect --file=${jbossCliScript} --echo-command
582582+ jboss-cli.sh --connect --file=${jbossCliScript} --echo-command
565583566584 cp configuration/standalone.xml $out
567585 '';
···570588571589 assertions = [
572590 {
573573- assertion = (cfg.databaseUseSSL && cfg.databaseType == "postgresql") -> (cfg.databaseCaCert != null);
574574- message = "A CA certificate must be specified (in 'services.keycloak.databaseCaCert') when PostgreSQL is used with SSL";
591591+ assertion = (cfg.database.useSSL && cfg.database.type == "postgresql") -> (cfg.database.caCert != null);
592592+ message = "A CA certificate must be specified (in 'services.keycloak.database.caCert') when PostgreSQL is used with SSL";
575593 }
576594 ];
577595···581599 after = [ "postgresql.service" ];
582600 before = [ "keycloak.service" ];
583601 bindsTo = [ "postgresql.service" ];
602602+ path = [ config.services.postgresql.package ];
584603 serviceConfig = {
585604 Type = "oneshot";
586605 RemainAfterExit = true;
···588607 Group = "postgres";
589608 };
590609 script = ''
591591- set -eu
610610+ set -o errexit -o pipefail -o nounset -o errtrace
611611+ shopt -s inherit_errexit
592612593593- PSQL=${config.services.postgresql.package}/bin/psql
613613+ create_role="$(mktemp)"
614614+ trap 'rm -f "$create_role"' ERR EXIT
594615595595- db_password="$(<'${cfg.databasePasswordFile}')"
596596- $PSQL -tAc "SELECT 1 FROM pg_roles WHERE rolname='keycloak'" | grep -q 1 || $PSQL -tAc "CREATE ROLE keycloak WITH LOGIN PASSWORD '$db_password' CREATEDB"
597597- $PSQL -tAc "SELECT 1 FROM pg_database WHERE datname = 'keycloak'" | grep -q 1 || $PSQL -tAc 'CREATE DATABASE "keycloak" OWNER "keycloak"'
616616+ echo "CREATE ROLE keycloak WITH LOGIN PASSWORD '$(<'${cfg.database.passwordFile}')' CREATEDB" > "$create_role"
617617+ psql -tAc "SELECT 1 FROM pg_roles WHERE rolname='keycloak'" | grep -q 1 || psql -tA --file="$create_role"
618618+ psql -tAc "SELECT 1 FROM pg_database WHERE datname = 'keycloak'" | grep -q 1 || psql -tAc 'CREATE DATABASE "keycloak" OWNER "keycloak"'
598619 '';
599620 };
600621···602623 after = [ "mysql.service" ];
603624 before = [ "keycloak.service" ];
604625 bindsTo = [ "mysql.service" ];
626626+ path = [ config.services.mysql.package ];
605627 serviceConfig = {
606628 Type = "oneshot";
607629 RemainAfterExit = true;
···609631 Group = config.services.mysql.group;
610632 };
611633 script = ''
612612- set -eu
634634+ set -o errexit -o pipefail -o nounset -o errtrace
635635+ shopt -s inherit_errexit
613636614614- db_password="$(<'${cfg.databasePasswordFile}')"
637637+ db_password="$(<'${cfg.database.passwordFile}')"
615638 ( echo "CREATE USER IF NOT EXISTS 'keycloak'@'localhost' IDENTIFIED BY '$db_password';"
616639 echo "CREATE DATABASE keycloak CHARACTER SET utf8 COLLATE utf8_unicode_ci;"
617640 echo "GRANT ALL PRIVILEGES ON keycloak.* TO 'keycloak'@'localhost';"
618618- ) | ${config.services.mysql.package}/bin/mysql -N
641641+ ) | mysql -N
619642 '';
620643 };
621644···634657 bindsTo = databaseServices;
635658 wantedBy = [ "multi-user.target" ];
636659 path = with pkgs; [
660660+ cfg.package
661661+ openssl
637662 replace-secret
638663 ];
639664 environment = {
···644669 serviceConfig = {
645670 ExecStartPre = let
646671 startPreFullPrivileges = ''
647647- set -eu
672672+ set -o errexit -o pipefail -o nounset -o errtrace
673673+ shopt -s inherit_errexit
648674649649- install -T -m 0400 -o keycloak -g keycloak '${cfg.databasePasswordFile}' /run/keycloak/secrets/db_password
650650- '' + lib.optionalString (cfg.certificatePrivateKeyBundle != null) ''
651651- install -T -m 0400 -o keycloak -g keycloak '${cfg.certificatePrivateKeyBundle}' /run/keycloak/secrets/ssl_cert_pk_bundle
675675+ umask u=rwx,g=,o=
676676+677677+ install -T -m 0400 -o keycloak -g keycloak '${cfg.database.passwordFile}' /run/keycloak/secrets/db_password
678678+ '' + lib.optionalString (cfg.sslCertificate != null && cfg.sslCertificateKey != null) ''
679679+ install -T -m 0400 -o keycloak -g keycloak '${cfg.sslCertificate}' /run/keycloak/secrets/ssl_cert
680680+ install -T -m 0400 -o keycloak -g keycloak '${cfg.sslCertificateKey}' /run/keycloak/secrets/ssl_key
652681 '';
653682 startPre = ''
654654- set -eu
683683+ set -o errexit -o pipefail -o nounset -o errtrace
684684+ shopt -s inherit_errexit
685685+686686+ umask u=rwx,g=,o=
655687656688 install -m 0600 ${cfg.package}/standalone/configuration/*.properties /run/keycloak/configuration
657689 install -T -m 0600 ${keycloakConfig} /run/keycloak/configuration/standalone.xml
···659691 replace-secret '@db-password@' '/run/keycloak/secrets/db_password' /run/keycloak/configuration/standalone.xml
660692661693 export JAVA_OPTS=-Djboss.server.config.user.dir=/run/keycloak/configuration
662662- ${cfg.package}/bin/add-user-keycloak.sh -u admin -p '${cfg.initialAdminPassword}'
663663- '' + lib.optionalString (cfg.certificatePrivateKeyBundle != null) ''
694694+ add-user-keycloak.sh -u admin -p '${cfg.initialAdminPassword}'
695695+ '' + lib.optionalString (cfg.sslCertificate != null && cfg.sslCertificateKey != null) ''
664696 pushd /run/keycloak/ssl/
665665- cat /run/keycloak/secrets/ssl_cert_pk_bundle <(echo) /etc/ssl/certs/ca-certificates.crt > allcerts.pem
666666- ${pkgs.openssl}/bin/openssl pkcs12 -export -in /run/keycloak/secrets/ssl_cert_pk_bundle -chain \
667667- -name "${cfg.frontendUrl}" -out certificate_private_key_bundle.p12 \
668668- -CAfile allcerts.pem -passout pass:notsosecretpassword
697697+ cat /run/keycloak/secrets/ssl_cert <(echo) \
698698+ /run/keycloak/secrets/ssl_key <(echo) \
699699+ /etc/ssl/certs/ca-certificates.crt \
700700+ > allcerts.pem
701701+ openssl pkcs12 -export -in /run/keycloak/secrets/ssl_cert -inkey /run/keycloak/secrets/ssl_key -chain \
702702+ -name "${cfg.frontendUrl}" -out certificate_private_key_bundle.p12 \
703703+ -CAfile allcerts.pem -passout pass:notsosecretpassword
669704 popd
670705 '';
671706 in [
···697732 };
698733699734 meta.doc = ./keycloak.xml;
735735+ meta.maintainers = [ lib.maintainers.talyz ];
700736}
+19-18
nixos/modules/services/web-apps/keycloak.xml
···4141 <productname>PostgreSQL</productname> or
4242 <productname>MySQL</productname>. Which one is used can be
4343 configured in <xref
4444- linkend="opt-services.keycloak.databaseType" />. The selected
4444+ linkend="opt-services.keycloak.database.type" />. The selected
4545 database will automatically be enabled and a database and role
4646 created unless <xref
4747- linkend="opt-services.keycloak.databaseHost" /> is changed from
4747+ linkend="opt-services.keycloak.database.host" /> is changed from
4848 its default of <literal>localhost</literal> or <xref
4949- linkend="opt-services.keycloak.databaseCreateLocally" /> is set
4949+ linkend="opt-services.keycloak.database.createLocally" /> is set
5050 to <literal>false</literal>.
5151 </para>
52525353 <para>
5454 External database access can also be configured by setting
5555- <xref linkend="opt-services.keycloak.databaseHost" />, <xref
5656- linkend="opt-services.keycloak.databaseUsername" />, <xref
5757- linkend="opt-services.keycloak.databaseUseSSL" /> and <xref
5858- linkend="opt-services.keycloak.databaseCaCert" /> as
5555+ <xref linkend="opt-services.keycloak.database.host" />, <xref
5656+ linkend="opt-services.keycloak.database.username" />, <xref
5757+ linkend="opt-services.keycloak.database.useSSL" /> and <xref
5858+ linkend="opt-services.keycloak.database.caCert" /> as
5959 appropriate. Note that you need to manually create a database
6060 called <literal>keycloak</literal> and allow the configured
6161 database user full access to it.
6262 </para>
63636464 <para>
6565- <xref linkend="opt-services.keycloak.databasePasswordFile" />
6565+ <xref linkend="opt-services.keycloak.database.passwordFile" />
6666 must be set to the path to a file containing the password used
6767- to log in to the database. If <xref linkend="opt-services.keycloak.databaseHost" />
6868- and <xref linkend="opt-services.keycloak.databaseCreateLocally" />
6767+ to log in to the database. If <xref linkend="opt-services.keycloak.database.host" />
6868+ and <xref linkend="opt-services.keycloak.database.createLocally" />
6969 are kept at their defaults, the database role
7070 <literal>keycloak</literal> with that password is provisioned
7171 on the local database instance.
···115115 </para>
116116117117 <para>
118118- For HTTPS support, a TLS certificate and private key is
119119- required. They should be <link
118118+ HTTPS support requires a TLS/SSL certificate and a private key,
119119+ both <link
120120 xlink:href="https://en.wikipedia.org/wiki/Privacy-Enhanced_Mail">PEM
121121- formatted</link> and concatenated into a single file. The path
122122- to this file should be configured in
123123- <xref linkend="opt-services.keycloak.certificatePrivateKeyBundle" />.
121121+ formatted</link>. Their paths should be set through <xref
122122+ linkend="opt-services.keycloak.sslCertificate" /> and <xref
123123+ linkend="opt-services.keycloak.sslCertificateKey" />.
124124 </para>
125125126126 <warning>
127127 <para>
128128- The path should be provided as a string, not a Nix path,
128128+ The paths should be provided as a strings, not a Nix paths,
129129 since Nix paths are copied into the world readable Nix store.
130130 </para>
131131 </warning>
···195195 <link linkend="opt-services.keycloak.initialAdminPassword">initialAdminPassword</link> = "e6Wcm0RrtegMEHl"; # change on first login
196196 <link linkend="opt-services.keycloak.frontendUrl">frontendUrl</link> = "https://keycloak.example.com/auth";
197197 <link linkend="opt-services.keycloak.forceBackendUrlToFrontendUrl">forceBackendUrlToFrontendUrl</link> = true;
198198- <link linkend="opt-services.keycloak.certificatePrivateKeyBundle">certificatePrivateKeyBundle</link> = "/run/keys/ssl_cert";
199199- <link linkend="opt-services.keycloak.databasePasswordFile">databasePasswordFile</link> = "/run/keys/db_password";
198198+ <link linkend="opt-services.keycloak.sslCertificate">sslCertificate</link> = "/run/keys/ssl_cert";
199199+ <link linkend="opt-services.keycloak.sslCertificateKey">sslCertificateKey</link> = "/run/keys/ssl_key";
200200+ <link linkend="opt-services.keycloak.database.passwordFile">database.passwordFile</link> = "/run/keys/db_password";
200201};
201202</programlisting>
202203 </para>
+3-3
nixos/modules/services/web-apps/mastodon.nix
···448448 join pg_namespace s on s.oid = c.relnamespace \
449449 where s.nspname not in ('pg_catalog', 'pg_toast', 'information_schema') \
450450 and s.nspname not like 'pg_temp%';" | sed -n 3p` -eq 0 ]; then
451451- SAFETY_ASSURED=1 rake db:schema:load
452452- rake db:seed
451451+ SAFETY_ASSURED=1 rails db:schema:load
452452+ rails db:seed
453453 else
454454- rake db:migrate
454454+ rails db:migrate
455455 fi
456456 '';
457457 path = [ cfg.package pkgs.postgresql ];