From 6c4b47a7ecef3a101b919c442be03fddd3144b57 Mon Sep 17 00:00:00 2001 From: atlas Date: Wed, 3 Jun 2026 16:33:44 +0200 Subject: [PATCH] docs: note ACME key file permissions for tls.certDir MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit security.acme defaults key to 0640 root:acme — nginx in the container can't read it. operator must set group = "nginx" on the ACME cert. addresses argus yellow note on PR #1153. --- docs/gateway.md | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/docs/gateway.md b/docs/gateway.md index fb1fd503..a582ca7c 100644 --- a/docs/gateway.md +++ b/docs/gateway.md @@ -197,6 +197,14 @@ The directory is bind-mounted read-only into the gateway container at `/run/hive `selfSignedTls = true` and `tls.certDir` set together is an assertion error. +**Key file permissions**: nixpkgs's `security.acme` outputs private keys as `0640 root:acme` by default. nginx inside the gateway container runs as the `nginx` user and cannot read a key with that ownership. Fix with: + +```nix +security.acme.certs."example.com".group = "nginx"; +``` + +or make the key world-readable (`0644`) if your threat model allows it. nginx errors out at startup on a key it can't read — the error is explicit in the journal, not a silent failure. + **Peer hive config**: when using a CA-signed cert, peer hives can declare this hive without `certFingerprint` in `swarm.peers` — the standard CA bundle validates: ```nix