nixos/kanidm: bind ca-bundle to validate url on provisioning (#409184)

2025-08-03 23:32:08 +02:00 · 2025-08-03 23:32:08 +02:00 · 02e4fa0530
commit 02e4fa0530
parent cf00bcb18b a73ba5c93a
1 changed files with 8 additions and 1 deletions
--- a/nixos/modules/services/security/kanidm.nix
+++ b/nixos/modules/services/security/kanidm.nix
@ -888,7 +888,14 @@ in
        (
          defaultServiceConfig
          // {
-            BindReadOnlyPaths = mergePaths (defaultServiceConfig.BindReadOnlyPaths ++ secretPaths);
+            BindReadOnlyPaths = mergePaths (
+              defaultServiceConfig.BindReadOnlyPaths
+              ++ secretPaths
+              ++ (lib.optionals (cfg.provision.enable && !cfg.provision.acceptInvalidCerts) [
+                "-/etc/ssl"
+                "-/etc/static/ssl"
+              ])
+            );
          }
        )
        {