home/nixos-servers
home/nixos-servers
2
0
Fork 0
Code Issues 8 Pull requests Projects Releases Packages Wiki Activity Actions

enable client certificate checking

Browse source
This commit is contained in:
Pim Kunis 2023-11-25 13:41:49 +01:00
parent d523da899c
commit 51f84c42ba
2 changed files with 9 additions and 7 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
flake.nix
View file

@ -39,6 +39,8 @@
# Should wait until this is merged in nixos-unstable.
# pkgs-unstable.nixos-anywhere
pkgs-unstable.deploy-rs
pkgs.openssl
pkgs.postgresql_15
];
};

14
modules/custom/terraform-database.nix
View file

@ -21,17 +21,17 @@ in {
enableTCPIP = true;
dataDir = lib.mkIf config.custom.dataDisk.enable
"/mnt/data/postgresql/${config.services.postgresql.package.psqlSchema}";
# dataDir =
# "/mnt/data/postgresql/${config.services.postgresql.package.psqlSchema}";
# TODO: for now trust, replace this with client certificate later
authentication = ''
hostssl terraformstates terraform all trust
hostssl terraformstates terraform all cert
'';
settings = {
ssl = true;
ssl_cert_file = builtins.toFile "postgresql_server.crt"
settings = let
serverCert = builtins.toFile "postgresql_server.crt"
(builtins.readFile ../../postgresql_server.crt);
in {
ssl = true;
ssl_cert_file = serverCert;
ssl_key_file = config.age.secrets."postgresql_server.key".path;
ssl_ca_file = serverCert;
};
ensureUsers = [{
name = "terraform";