nixos/web-servers: assert ACME cert access via service user and groups

Allows giving access using SupplementaryGroups.

nixos/modules/security/acme/mk-cert-ownership-assertion.nix

@@ -1,4 +1,21 @@
-{ cert, group, groups, user }: {
-  assertion = cert.group == group || builtins.any (u: u == user) groups.${cert.group}.members;
-  message = "Group for certificate ${cert.domain} must be ${group}, or user ${user} must be a member of group ${cert.group}";
+lib:
+
+{ cert, groups, services }:
+let
+  catSep = builtins.concatStringsSep;
+
+  svcGroups = svc:
+    (lib.optional (svc.serviceConfig ? Group) svc.serviceConfig.Group)
+    ++ (svc.serviceConfig.SupplementaryGroups or [ ]);
+in
+{
+  assertion = builtins.all (svc:
+    svc.serviceConfig.User or "root" == "root"
+    || builtins.elem svc.serviceConfig.User groups.${cert.group}.members
+    || builtins.elem cert.group (svcGroups svc)
+  ) services;
+
+  message = "Certificate ${cert.domain} (group=${cert.group}) must be readable by service(s) ${
+    catSep ", " (map (svc: "${svc.name} (user=${svc.serviceConfig.User} groups=${catSep " " (svcGroups svc)})") services)
+  }";
 }

nixos/modules/services/web-servers/apache-httpd/default.nix

@@ -372,7 +372,7 @@ let
       echo "$options" >> $out
     '';
 
-  mkCertOwnershipAssertion = import ../../../security/acme/mk-cert-ownership-assertion.nix;
+  mkCertOwnershipAssertion = import ../../../security/acme/mk-cert-ownership-assertion.nix lib;
 in
 
 
@@ -642,9 +642,9 @@ in
         '';
       }
     ] ++ map (name: mkCertOwnershipAssertion {
-      inherit (cfg) group user;
       cert = config.security.acme.certs.${name};
       groups = config.users.groups;
+      services = [ config.systemd.services.httpd ] ++ lib.optional (vhostCertNames != []) config.systemd.services.httpd-config-reload;
     }) vhostCertNames;
 
     warnings =
@@ -792,7 +792,7 @@ in
     systemd.services.httpd-config-reload = let
       sslServices = map (certName: "acme-${certName}.service") vhostCertNames;
       sslTargets = map (certName: "acme-finished-${certName}.target") vhostCertNames;
-    in mkIf (sslServices != []) {
+    in mkIf (vhostCertNames != []) {
       wantedBy = sslServices ++ [ "multi-user.target" ];
       # Before the finished targets, after the renew services.
       # This service might be needed for HTTP-01 challenges, but we only want to confirm

nixos/modules/services/web-servers/caddy/default.nix

@@ -54,7 +54,7 @@ let
 
   configPath = "/etc/${etcConfigFile}";
 
-  mkCertOwnershipAssertion = import ../../../security/acme/mk-cert-ownership-assertion.nix;
+  mkCertOwnershipAssertion = import ../../../security/acme/mk-cert-ownership-assertion.nix lib;
 in
 {
   imports = [
@@ -330,9 +330,9 @@ in
         message = "To specify an adapter other than 'caddyfile' please provide your own configuration via `services.caddy.configFile`";
       }
     ] ++ map (name: mkCertOwnershipAssertion {
-      inherit (cfg) group user;
       cert = config.security.acme.certs.${name};
       groups = config.users.groups;
+      services = [ config.systemd.services.caddy ];
     }) vhostCertNames;
 
     services.caddy.globalConfig = ''

nixos/modules/services/web-servers/nginx/default.nix

@@ -472,7 +472,7 @@ let
     '') authDef)
   );
 
-  mkCertOwnershipAssertion = import ../../../security/acme/mk-cert-ownership-assertion.nix;
+  mkCertOwnershipAssertion = import ../../../security/acme/mk-cert-ownership-assertion.nix lib;
 
   oldHTTP2 = (versionOlder cfg.package.version "1.25.1" && !(cfg.package.pname == "angie" || cfg.package.pname == "angieQuic"));
 in
@@ -1210,9 +1210,9 @@ in
         '';
       }
     ] ++ map (name: mkCertOwnershipAssertion {
-      inherit (cfg) group user;
       cert = config.security.acme.certs.${name};
       groups = config.users.groups;
+      services = [ config.systemd.services.nginx ] ++ lib.optional (cfg.enableReload || vhostCertNames != []) config.systemd.services.nginx-config-reload;
     }) vhostCertNames;
 
     services.nginx.additionalModules = optional cfg.recommendedBrotliSettings pkgs.nginxModules.brotli
@@ -1319,7 +1319,7 @@ in
     systemd.services.nginx-config-reload = let
       sslServices = map (certName: "acme-${certName}.service") vhostCertNames;
       sslTargets = map (certName: "acme-finished-${certName}.target") vhostCertNames;
-    in mkIf (cfg.enableReload || sslServices != []) {
+    in mkIf (cfg.enableReload || vhostCertNames != []) {
       wants = optionals cfg.enableReload [ "nginx.service" ];
       wantedBy = sslServices ++ [ "multi-user.target" ];
       # Before the finished targets, after the renew services.