hosts/losurdo/acme/autogeree.net.nix

   1 {
   2   pkgs,
   3   lib,
   4   config,
   5   inputs,
   6   hosts,
   7   hostName,
   8   info,
   9   ...
  10 }:
  11 let
  12   domain = "autogeree.net";
  13   domainID = lib.replaceStrings [ "." ] [ "_" ] domain;
  14   inherit (config.users) groups;
  15 in
  16 {
  17   networking.nftables.ruleset = ''
  18     table inet filter {
  19       # ACME DNS-01 challenge and Gandi DNS
  20       set output-net-lego-ipv4 {
  21         type ipv4_addr
  22         elements = {
  23           ${hosts.mermet._module.args.ipv4},
  24           ${lib.concatMapStringsSep ", " ({ ipv4, ... }: ipv4) (
  25             lib.filter (args: args ? "ipv4") info.lebureau.dns.secondary.ns
  26           )}
  27         }
  28       }
  29       set output-net-lego-ipv6 {
  30         type ipv6_addr
  31         elements = {
  32           ${lib.concatMapStringsSep ", " ({ ipv6, ... }: ipv6) (
  33             lib.filter (args: args ? "ipv6") info.lebureau.dns.secondary.ns
  34           )}
  35         }
  36       }
  37     }
  38   '';
  39   security.acme.certs."${domain}" = {
  40     email = "root+letsencrypt@${domain}";
  41     extraDomainNames = [
  42       "*.${domain}"
  43     ];
  44     group = groups.acme.name;
  45     keyType = "rsa4096";
  46     dnsProvider = "rfc2136";
  47     # ns6.gandi.net takes roughly 5min to update
  48     # hence lego's RFC2136_PROPAGATION_TIMEOUT=1000
  49     #dnsPropagationCheck = false;
  50     credentialsFile = pkgs.writeText "acme-credentials-${domain}" ''
  51       RFC2136_NAMESERVER=ns.${domain}:53
  52       RFC2136_TSIG_ALGORITHM=hmac-sha256.
  53       RFC2136_TSIG_KEY=acme_${domainID}
  54       RFC2136_PROPAGATION_TIMEOUT=1000
  55       RFC2136_POLLING_INTERVAL=30
  56       RFC2136_SEQUENCE_INTERVAL=30
  57       RFC2136_DNS_TIMEOUT=1000
  58       RFC2136_TTL=1
  59     '';
  60   };
  61   systemd.services."acme-${domain}" = {
  62     serviceConfig.LoadCredentialEncrypted = [
  63       "${domain}.tsig:${./. + "/${domain}.tsig.cred"}"
  64     ];
  65     environment.RFC2136_TSIG_SECRET_FILE = "%d/${domain}.tsig";
  66     after = [ "unbound.service" ];
  67   };
  68 }