From 3c2e85ed4a89cba7d41d32c7182afcc1ff98e0cc Mon Sep 17 00:00:00 2001
From: Jan-Eric Hellenberg <janeric.hellenberg@gmail.com>
Date: Thu, 29 Jul 2021 15:41:06 +0200
Subject: [PATCH] Correct destination of nomad-ca.crt template to be inside
 NOMAD_SECRETS_DIR

---
 .gitlab-ci.yml       |  1 +
 deploy/api.tpl.nomad | 11 ++++++++---
 2 files changed, 9 insertions(+), 3 deletions(-)

diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index 33381e7..8f73d7a 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -147,6 +147,7 @@ test_e2e:
     - export NOMAD_NAMESPACE="$NOMAD_SLUG"
     - nomad namespace apply $NOMAD_NAMESPACE
   script:
+    - export NOMAD_CACERT_DATA=$(cat $NOMAD_CACERT)
     # Only replace set env vars
     - envsubst "$(env | sed -e 's/=.*//' -e 's/^/\$/g')" < deploy/api.tpl.nomad > deploy/api.nomad
     # Make sure to set NOMAD_ADDR, NOMAD_SKIP_VERIFY and NOMAD_TOKEN env vars in CI settings appropriately
diff --git a/deploy/api.tpl.nomad b/deploy/api.tpl.nomad
index fb97dbd..f8a5bde 100644
--- a/deploy/api.tpl.nomad
+++ b/deploy/api.tpl.nomad
@@ -62,8 +62,13 @@ job "${NOMAD_SLUG}" {
       }
 
       template {
-          source        = "${NOMAD_CACERT}"
-          destination   = "/home/api/nomad-ca.crt"
+          data          = <<EOH
+${NOMAD_CACERT_DATA}
+EOH
+          // Note that only some destinations are allowed here
+          // (see https://www.nomadproject.io/docs/job-specification/template#destination).
+          // The secrets folder (NOMAD_SECRETS_DIR) is one of them.
+          destination   = "secrets/nomad-ca.crt"
           change_mode   = "noop"
       }
 
@@ -73,7 +78,7 @@ job "${NOMAD_SLUG}" {
         POSEIDON_NOMAD_NAMESPACE  = "${NOMAD_NAMESPACE}"
         POSEIDON_NOMAD_TOKEN      = "${DEPLOY_POSEIDON_NOMAD_TOKEN}"
         POSEIDON_NOMAD_TLS_ACTIVE = "${DEPLOY_POSEIDON_NOMAD_TLS_ACTIVE}"
-        POSEIDON_NOMAD_TLS_CAFILE = "nomad-ca.crt"
+        POSEIDON_NOMAD_TLS_CAFILE = "/secrets/nomad-ca.crt"
       }
 
       resources {