hosts/losurdo/acme/autogeree.net.nix

   1 { lib, config, inputs, hosts, hostName, ... }:
   2 let
   3   domain = "autogeree.net";
   4   domainID = lib.replaceStrings [ "." ] [ "_" ] domain;
   5   inherit (config.users) groups;
   6 in
   7 {
   8   networking.nftables.ruleset = ''
   9     table inet filter {
  10       # ACME DNS-01 challenge and Gandi DNS
  11       set output-net-lego-ipv4 {
  12         type ipv4_addr
  13         elements = {
  14           ${hosts.mermet._module.args.ipv4},
  15           217.70.177.40
  16         }
  17       }
  18       set output-net-lego-ipv6 {
  19         type ipv6_addr
  20         elements = {
  21           2001:4b98:d:1::40
  22         }
  23       }
  24     }
  25   '';
  26   security.acme.certs."${domain}" = {
  27     email = "root+letsencrypt@${domain}";
  28     extraDomainNames = [
  29       "*.${domain}"
  30     ];
  31     group = groups.acme.name;
  32     keyType = "rsa4096";
  33     dnsProvider = "rfc2136";
  34     # ns6.gandi.net takes roughly 5min to update
  35     # hence lego's RFC2136_PROPAGATION_TIMEOUT=1000
  36     #dnsPropagationCheck = false;
  37     credentialsFile = "/dev/null";
  38     validMinDays = 10;
  39   };
  40   systemd.services."acme-${domain}" = {
  41     serviceConfig.LoadCredentialEncrypted =
  42       [ "${domain}.tsig:${inputs.self}/hosts/${hostName}/acme/${domain}.tsig.cred" ];
  43     environment = {
  44       RFC2136_TSIG_SECRET = "%d/${domain}.tsig";
  45       RFC2136_NAMESERVER = "ns.${domain}:53";
  46       RFC2136_TSIG_ALGORITHM = "hmac-sha256.";
  47       RFC2136_TSIG_KEY = "acme_${domainID}";
  48       RFC2136_PROPAGATION_TIMEOUT = "1000";
  49       RFC2136_POLLING_INTERVAL = "30";
  50       RFC2136_SEQUENCE_INTERVAL = "30";
  51       RFC2136_DNS_TIMEOUT = "1000";
  52       RFC2136_TTL = "1";
  53     };
  54     after = [ "unbound.service" ];
  55   };
  56 }