1 { lib, config, inputs, hosts, hostName, ... }:
3 domain = "sourcephile.fr";
4 domainID = lib.replaceStrings [ "." ] [ "_" ] domain;
5 inherit (config.users) groups;
8 networking.nftables.ruleset = ''
10 # ACME DNS-01 challenge and Gandi DNS
11 set output-net-lego-ipv4 {
14 ${hosts.mermet._module.args.ipv4},
18 set output-net-lego-ipv6 {
20 elements = { 2001:4b98:d:1::40 }
24 security.acme.certs."${domain}" = {
25 email = "root+letsencrypt@${domain}";
29 group = groups.acme.name;
31 dnsProvider = "rfc2136";
32 # ns6.gandi.net takes roughly 5min to update
33 # hence lego's RFC2136_PROPAGATION_TIMEOUT=1000
34 #dnsPropagationCheck = false;
35 credentialsFile = "/dev/null";
37 systemd.services."acme-${domain}" = {
38 serviceConfig.LoadCredentialEncrypted =
39 [ "${domain}.tsig:${inputs.self}/hosts/${hostName}/acme/${domain}.tsig.cred" ];
41 RFC2136_TSIG_SECRET = "%d/${domain}.tsig";
42 RFC2136_NAMESERVER = "ns.${domain}:53";
43 RFC2136_TSIG_ALGORITHM = "hmac-sha256.";
44 RFC2136_TSIG_KEY = "acme_${domainID}";
45 RFC2136_PROPAGATION_TIMEOUT = "1000";
46 RFC2136_POLLING_INTERVAL = "30";
47 RFC2136_SEQUENCE_INTERVAL = "30";
48 RFC2136_DNS_TIMEOUT = "1000";
51 after = [ "unbound.service" ];