Commits on Apr 27, 2017

1. Stop storing keys in the nix store for storeKeysOnMachine. …

   This patch changes storeKeysOnMachine to work roughly the same way when
   true as when false. The only difference is that the keys are stored in
   /var/keys (which is usually a real disk) as opposed to /run/keys (which
   is RAM).
   
   This is an improvement on the previous version of storeKeysOnMachine
   where the keys were stored in the Nix store and linked from /run/keys.
   The previous version doesn't allow setting unix permissions on the keys,
   meaning any process on the server can read all keys.
   
   This solution has the downside that rolling back doesn't roll back the
   keys, however this is consistent with how storeKeysOnMachine=false works
   so shouldn't be a major concern. Furthermore if someone wants to have
   the keys rollback with the system they can use builtins.toFile instead
   of the keys mechanism which works the same way that the previous
   storeKeysOnMachine=true worked.
   
   Additionally a symlink /etc/nixops-keys has been added that will be set
   to the appropriate key location to make it easier to switch between the
   options.

   

   kevincox committed Apr 27, 2017
   Configuration menu

   • View commit details
   • Copy full SHA for 1d2530a
   • Browse repository at this point

   Copy the full SHA

   1d2530a View commit details

   Browse the repository at this point in the history