diff mbox series

[bug#63877] gnu: services: web: Set SSL_CERT_DIR in php-fpm environment.

Message ID 3fec02d93b8e7803dd8183e7f0037ec1a1393b0f.1685816572.git.guix@twilken.net
State New
Headers show
Series [bug#63877] gnu: services: web: Set SSL_CERT_DIR in php-fpm environment. | expand

Commit Message

Timo Wilken June 3, 2023, 6:25 p.m. UTC 
Some PHP programs, like Nextcloud, make HTTPS requests to other servers. For
this, they need to know where the system CA certificates are.

* gnu/services/web.scm (php-fpm-shepherd-service): Set SSL_CERT_DIR
  environment variable.
---

This solution adds a dependency from the resulting Shepherd service to the
nss-certs package, which weighs 0.3 MiB. An alternative solution might be to
set SSL_CERT_DIR=/etc/ssl/certs instead and rely on nss-certs being installed
system-wide.

 gnu/services/web.scm | 7 +++++++
 1 file changed, 7 insertions(+)


base-commit: 66c9b82fed3c59ee07187898592c688c82fed273

Comments

Bruno Victal June 3, 2023, 10:18 p.m. UTC | #1 
Hi Timo,

On 2023-06-03 19:25, Timo Wilken wrote:
> Some PHP programs, like Nextcloud, make HTTPS requests to other servers. For
> this, they need to know where the system CA certificates are.
> 
> * gnu/services/web.scm (php-fpm-shepherd-service): Set SSL_CERT_DIR
>   environment variable.
> ---
> 
> This solution adds a dependency from the resulting Shepherd service to the
> nss-certs package, which weighs 0.3 MiB. An alternative solution might be to
> set SSL_CERT_DIR=/etc/ssl/certs instead and rely on nss-certs being installed
> system-wide.

How about exposing this as a new environment-variable record field à
la mpd-configuration (gnu services audio)?
Forcing the service to use a specific package seems overly rigid since
it would make it impossible to specify alternate/custom certificates or
nss-certs package variants.
diff mbox series

Patch

diff --git a/gnu/services/web.scm b/gnu/services/web.scm
index 45897d7d6f..e46710a040 100644
--- a/gnu/services/web.scm
+++ b/gnu/services/web.scm
@@ -16,6 +16,7 @@ 
 ;;; Copyright © 2020, 2021 Alexandru-Sergiu Marton <brown121407@posteo.ro>
 ;;; Copyright © 2022 Simen Endsjø <simendsjo@gmail.com>
 ;;; Copyright © 2023 Bruno Victal <mirai@makinata.eu>
+;;; Copyright © 2023 Timo Wilken <guix@twilken.net>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -1096,6 +1097,12 @@  (define php-fpm-shepherd-service
                         #$@(if php-ini-file
                                `("-c" ,php-ini-file)
                                '()))
+                      #:environment-variables
+                      (cons*
+                       ;; Needed by e.g. Nextcloud to make HTTPS requests.
+                       (string-append
+                        "SSL_CERT_DIR=" #$(file-append nss-certs "/etc/ssl/certs"))
+                       (default-environment-variables))
                       #:pid-file #$pid-file))
             (stop #~(make-kill-destructor)))))))