hosts/losurdo/acme/sourcephile.fr.nix

   1 { pkgs, lib, config, hosts, ... }:
   2 let
   3   domain = "sourcephile.fr";
   4   domainID = lib.replaceStrings ["."] ["_"] domain;
   5   inherit (config.security) gnupg;
   6   inherit (config.users) users groups;
   7 in
   8 {
   9 networking.nftables.ruleset = ''
  10   # for lego to update ACME DNS-01 challenge
  11   add rule inet filter fw2net ip daddr ${hosts.mermet._module.args.ipv4} meta l4proto { udp, tcp } th dport 53 counter accept comment "ACME DNS-01"
  12   # for lego to check DNS propagation on ns6.gandi.net
  13   add rule inet filter fw2net ip daddr 217.70.177.40 meta l4proto { udp, tcp } th dport 53 skuid ${users.acme.name} counter accept comment "DNS gandi"
  14   add rule inet filter fw2net ip6 daddr 2001:4b98:d:1::40 meta l4proto { udp, tcp } th dport 53 skuid ${users.acme.name} counter accept comment "DNS gandi"
  15 '';
  16 security.acme.certs."${domain}" = {
  17   email = "root+letsencrypt@${domain}";
  18   extraDomainNames = [
  19     "*.${domain}"
  20   ];
  21   group = groups.acme.name;
  22   keyType = "rsa4096";
  23   dnsProvider = "rfc2136";
  24   # ns6.gandi.net takes roughly 5min to update
  25   # hence lego's RFC2136_PROPAGATION_TIMEOUT=1000
  26   #dnsPropagationCheck = false;
  27   credentialsFile = gnupg.secrets."lego/${domain}/rfc2136".path;
  28 };
  29 security.gnupg.secrets."lego/${domain}/rfc2136" = {
  30   pipe = ''
  31     cat - ${pkgs.writeText "env" ''
  32     RFC2136_NAMESERVER=ns.${domain}:53
  33     RFC2136_TSIG_ALGORITHM=hmac-sha256.
  34     RFC2136_TSIG_KEY=acme_${domainID}
  35     RFC2136_PROPAGATION_TIMEOUT=1000
  36     RFC2136_POLLING_INTERVAL=30
  37     RFC2136_SEQUENCE_INTERVAL=30
  38     RFC2136_DNS_TIMEOUT=1000
  39     RFC2136_TTL=1
  40     ''}
  41   '';
  42 };
  43 systemd.services."acme-${domain}" = {
  44   after = [
  45     "unbound.service"
  46     gnupg.secrets."lego/${domain}/rfc2136".service
  47   ];
  48   wants = [
  49     "unbound.service"
  50     gnupg.secrets."lego/${domain}/rfc2136".service
  51   ];
  52 };
  53 }