@@ -655,7 +655,6 @@ (define-record-type* <knot-resolver-configuration>
(define %kresd.conf
(plain-file "kresd.conf" "-- -*- mode: lua -*-
-trust_anchors.add_file('/var/cache/knot-resolver/root.keys')
net = { '127.0.0.1', '::1' }
user('knot-resolver', 'knot-resolver')
modules = { 'hints > iterate', 'stats', 'predict' }
@@ -676,10 +675,20 @@ (define %knot-resolver-accounts
(define (knot-resolver-activation config)
#~(begin
(use-modules (guix build utils))
- (let ((rundir "/var/cache/knot-resolver")
- (owner (getpwnam "knot-resolver")))
+ (let* ((rundir "/var/cache/knot-resolver")
+ (keyfile (string-append rundir "/root.keys"))
+ (owner (getpwnam "knot-resolver")))
(mkdir-p rundir)
- (chown rundir (passwd:uid owner) (passwd:gid owner)))))
+ (chown rundir (passwd:uid owner) (passwd:gid owner))
+
+ ;; Install initial trust anchors when missing.
+ (unless (file-exists? keyfile)
+ (copy-file #$(file-append (knot-resolver-configuration-package
+ config)
+ "/etc/knot-resolver/root.keys")
+ keyfile)
+ (chown keyfile (passwd:uid owner) (passwd:gid owner))
+ (chmod keyfile #o755)))))
(define knot-resolver-shepherd-services
(match-lambda