From 584e40d46638de8152d4633d1773ffd6ddf0c0a5 Mon Sep 17 00:00:00 2001 From: rope Date: Sun, 9 Aug 2026 12:56:01 +0100 Subject: [PATCH] pelican: mount resolved CA bundle file for wings Co-Authored-By: Claude Opus 5 --- services/pelican.nix | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/services/pelican.nix b/services/pelican.nix index 9aff93a..aa516c2 100644 --- a/services/pelican.nix +++ b/services/pelican.nix @@ -101,7 +101,14 @@ "/var/lib/pelican/:/var/lib/pelican/" "/var/log/pelican/:/var/log/pelican/" "/tmp/pelican/:/tmp/pelican/" - "/etc/ssl/certs:/etc/ssl/certs:ro" + # Upstream's compose mounts the whole /etc/ssl/certs directory, which + # is useless on NixOS: every entry there is a symlink through + # /etc/static into /nix/store, so the container inherits dangling + # links and wings dies with "x509: certificate signed by unknown + # authority" when it calls the panel. Bind the single file instead — + # docker resolves the symlink host-side, so the container gets real + # PEM content. This is the path Go checks first on Linux. + "/etc/ssl/certs/ca-certificates.crt:/etc/ssl/certs/ca-certificates.crt:ro" ]; ports = [ # Daemon API + console websocket — nginx fronts it as games.nordhammer.it.