-
-
Notifications
You must be signed in to change notification settings - Fork 14k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
nixos/acme: add option to delay renewal untill after other units #221363
base: master
Are you sure you want to change the base?
Conversation
cb83996
to
317a64d
Compare
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Reviewed points
- changes are backward compatible
-
removed options are declared withn/amkRemovedOptionModule
-
changes that are not backward compatible are documented in release notesn/a - module tests succeed on ARCHITECTURE
- options types are appropriate
- options description is set
- options example is provided
- documentation affected by the changes is updated
Possible improvements
The options example is not provided, however the ACME documentation contains a full example of how to use this mechanism.
Maybe the documentation could be linked, I don't know how though, and I think this change is sufficient as-is.
Comments
lgtm
317a64d
to
eb9ce72
Compare
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
This looks good, however what do you think of adding the time sync dependency by default? Seems like it would be a common enough concern
FYI, enabling
IMHO, the issue that cert renewal before time is synced after boot is not common and I never have such issue. Will a retry after time is synced fix this issue? Does our acme module have a retry mechanism? I am not sure. |
I expect that the only reason I ran into the issue was because the system is a raspberry pi with a non-persistent Most setups probably don't have a lot of clock drift at boot |
- allow adding additional units to the `after` section - add documentation for delaying renewal untill after timesync is done
eb9ce72
to
c95e1ee
Compare
after
sectionDescription of changes
Things done
sandbox = true
set innix.conf
? (See Nix manual)nix-shell -p nixpkgs-review --run "nixpkgs-review rev HEAD"
. Note: all changes have to be committed, also see nixpkgs-review usage./result/bin/
)