Merge pull request #87006 from aanderse/duo-20.03-fix

duosec: fix module [20.03]
NixOS · May 5, 2020 · 8258818 · 8258818
2 parents 986799d + 55f53dd
commit 8258818
Showing 1 changed file with 12 additions and 17 deletions.
diff --git a/nixos/modules/security/duosec.nix b/nixos/modules/security/duosec.nix
@@ -24,22 +24,6 @@ let
     motd=${boolToStr cfg.motd}
     accept_env_factor=${boolToStr cfg.acceptEnvFactor}
   '';
-
-  loginCfgFile = optionalAttrs cfg.ssh.enable {
-    "duo/login_duo.conf" =
-      { source = pkgs.writeText "login_duo.conf" configFileLogin;
-        mode   = "0600";
-        user   = "sshd";
-      };
-  };
-
-  pamCfgFile = optional cfg.pam.enable {
-    "duo/pam_duo.conf" =
-      { source = pkgs.writeText "pam_duo.conf" configFilePam;
-        mode   = "0600";
-        user   = "sshd";
-      };
-  };
 in
 {
   imports = [
@@ -198,7 +182,18 @@ in
      environment.systemPackages = [ pkgs.duo-unix ];
 
      security.wrappers.login_duo.source = "${pkgs.duo-unix.out}/bin/login_duo";
-     environment.etc = loginCfgFile // pamCfgFile;
+
+     environment.etc."duo/login_duo.conf" = mkIf cfg.ssh.enable
+       { source = pkgs.writeText "login_duo.conf" configFileLogin;
+         mode = "0600";
+         user = "sshd";
+       };
+
+     environment.etc."duo/pam_duo.conf" = mkIf cfg.pam.enable
+       { source = pkgs.writeText "pam_duo.conf" configFilePam;
+         mode = "0600";
+         user = "sshd";
+       };
 
      /* If PAM *and* SSH are enabled, then don't do anything special.
      If PAM isn't used, set the default SSH-only options. */