This repository has no description
services.pad: provide dhparams ourselves after security.dhparams removal
The security.dhparams module was removed from nixpkgs (RFC 7919), but
HedgeDoc's HTTPS listener unconditionally readFileSync()s dhParamPath at
startup. With the path unset it read a directory (EISDIR) and crash-looped,
taking pad.lassul.us down. Point dhParamPath back at the existing file and
add an ExecStartPre that regenerates it with openssl if missing.
Assisted-by: Claude Code (claude-opus-4-8[1m])
author
lassulus
date
(Jun 17, 2026, 4:43 PM CEST)
commit
2cf14afa
2cf14afa1f881123ee18d932d07b7b00897abbde
parent
1a9a1297
1a9a12972108430e171689b50e40a970a2894f59
+18
-6
+18
-6
2configs/services/pad/module.nix
+18
-6
2configs/services/pad/module.nix
···
19
19
"nginx"
20
20
];
21
21
22
-
security.dhparams = {
23
-
enable = true;
24
-
params.hedgedoc = { };
25
-
};
26
-
27
22
services.hedgedoc = {
28
23
enable = true;
29
24
settings = {
···
46
41
sslCAPath = [ "/etc/ssl/certs/ca-certificates.crt" ];
47
42
sslCertPath = "/var/lib/acme/${config.clan.hedgedoc.domain}/cert.pem";
48
43
sslKeyPath = "/var/lib/acme/${config.clan.hedgedoc.domain}/key.pem";
49
-
dhParamPath = config.security.dhparams.params.hedgedoc.path;
44
+
dhParamPath = "/var/lib/dhparams/hedgedoc.pem";
50
45
};
51
46
};
47
+
48
+
# security.dhparams was removed from nixpkgs (RFC 7919), but HedgeDoc's
49
+
# HTTPS listener unconditionally reads dhParamPath. Generate the params
50
+
# ourselves if missing so the service stays self-contained.
51
+
systemd.services.hedgedoc.serviceConfig.ExecStartPre = [
52
+
(
53
+
"+"
54
+
+ pkgs.writeShellScript "hedgedoc-dhparam" ''
55
+
set -eu
56
+
if [ ! -s /var/lib/dhparams/hedgedoc.pem ]; then
57
+
mkdir -p /var/lib/dhparams
58
+
${pkgs.openssl}/bin/openssl dhparam -out /var/lib/dhparams/hedgedoc.pem 2048
59
+
chmod 644 /var/lib/dhparams/hedgedoc.pem
60
+
fi
61
+
''
62
+
)
63
+
];
52
64
53
65
systemd.services.hedgedoc.serviceConfig.SystemCallFilter = [
54
66
"fchown"