Sovran_Systems/Sovran_SystemsOS
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: desktop-only safety fixes (nix-bitcoin compat, mkForce, conditional caddy)

Browse Source 
1. Add nix-bitcoin.generateSecrets = lib.mkDefault true global compat
   default in role-logic.nix so Desktop Only systems can evaluate while
   nix-bitcoin is still globally imported by the flake.

2. Harden Desktop Only role: change all server/node service and feature
   disables from lib.mkDefault false to lib.mkForce false so they cannot
   be overridden by custom.nix or option defaults.
   - sovran_systemsOS.services: synapse, bitcoin, vaultwarden, wordpress, nextcloud
   - sovran_systemsOS.features: haven, mempool, element-calling, bitcoin-core
   - sovran_systemsOS.web.btcpayserver

3. Make Caddy conditional in caddy.nix:
   enable = needsHttpsPorts || extraVhosts != ""
   so Caddy does not run on Desktop Only installs with no web services.
This commit is contained in:
copilot-swe-agent[bot]
2026-07-03 23:35:30 +00:00
committed by GitHub
parent afe51c4abd
commit e81f6643fc
2 changed files with 26 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
modules/core/caddy.nix
+4 -1
View File
@@ -16,7 +16,10 @@ let
in
{
services.caddy = {
enable = true;
# Only enable Caddy when at least one domain-based service needs it or
# the operator has defined custom vhosts. This prevents Caddy from
# running on Desktop Only installs that have no web services configured.
enable = needsHttpsPorts || extraVhosts != "";
user = "caddy";
group = "root";
};