NixOS/nixpkgs — pull request #2092 by chrisfarms (2014-04-01 10:35:37+00:00)
Title: Add options for enabling libvirtd TLS and certificates in nixos

## Libvirtd remote connections

libvirtd requires that you setup TLS server (and potentially client) certificates and keys to enable remote connections.

To allow this to be configured in nixos this patch makes the following options available:

* **virtualisation.libvirtd.listen** Starts libvirtd with the listen_tls option. (Default: false)
* **virtualisation.libvirtd.authorityCert** Sets the trusted CA certificate in pem format. (Default: "")
* **virtualisation.libvirtd.serverCert** Sets the server´s certificate signed by the CA. (Default: "")
* **virtualisation.libvirtd.serverKey** Sets the server´s private key. (Default: "")
* **virtualisation.libvirtd.clientCert** Sets the default client certificate signed by the CA in pem format. (Default: "")
* **virtualisation.libvirtd.clientKey** Sets the default client key. (Default: "")

## Systemd tweak.

I was also seeing issues where libvirtd would not shutdown or restart correctly when running with `listen` enabled. By removing the "--daemon" option and letting systemd manage the process without forking seemed to resolve this.

**I believe removing the `--daemon` option has made the "post-start" script redundant (as systemd correctly waits anyway). Was there any reason why libvirtd was set to fork? What was the purpose of the post-start script?**