nixos/doc: fix acme dns-01 example #190052
Conversation
Summary: fix errors with example code in the manual that shows how to set up DNS-01 verification via the acme protocol, e.g. for those who want to get wildcard certificates from Let's Encrypt. Fix syntax error in nix arrays (there should not be commas.) Fix permissions on /var/lib/secrets so it can be read by bind daemon. Without this fix bind won't start. Add the missing feature: put the generated secret into certs.secret
github-actions
bot
added
6.topic: nixos
ofborg
bot
added
10.rebuild-darwin: 0
|
@winterqt We good to go on this? I'm hoping we can get it merged before it bit-rots. |
bobby285271
added
the
12.approvals: 1
|
|
||
| cat > /var/lib/secrets/certs.secret << EOF | ||
| RFC2136_NAMESERVER='127.0.0.1:53' | ||
| RFC2136_TSIG_ALGORITHM='hmac-sha256.' | ||
| RFC2136_TSIG_KEY='rfc2136key.example.com' | ||
| RFC2136_TSIG_SECRET='your secret key' | ||
| RFC2136_TSIG_SECRET='$secret' |
There was a problem hiding this comment.
Slight change: Should be using double quotes here since you want the var from the shell
| RFC2136_TSIG_SECRET='$secret' | |
| RFC2136_TSIG_SECRET="$secret" |
There was a problem hiding this comment.
Yes, this would not work at all due to this -- single quotes don't expand anything.
@JasonWoof Did you test this at all? I ask since it shouldn't work without double quotes here.
Happy to merge once you fix this.
There was a problem hiding this comment.
It works with single quotes. That's how it is in the version I'm using.
The single quotes don't interfere with $secret expanding. bash expands variables in that whole line because it's within a <<EOF section
There was a problem hiding this comment.
Ah I totally missed that!
There was a problem hiding this comment.
I thought you had found a bug until I looked at my in-production working version, and saw that it was working with single quotes. Then I figured out why it works this way :)
bobby285271
added
12.approvals: 2
|
anything I can do to help this along? |
Summary: fix errors with example code in the manual that shows how to set up DNS-01 verification via the acme protocol, e.g. for those who want to get wildcard certificates from Let's Encrypt.
Fix syntax error in nix arrays (there should not be commas.)
Fix permissions on /var/lib/secrets so it can be read by bind daemon. Without this fix bind won't start.
Add the missing feature: put the generated secret into certs.secret
Description of changes
Things done
sandbox = trueset innix.conf? (See Nix manual)nix-shell -p nixpkgs-review --run "nixpkgs-review rev HEAD". Note: all changes have to be committed, also see nixpkgs-review usage./result/bin/)nixos/doc/manual/md-to-db.shto update generated release notes