servers/losurdo/acme/sourcephile.fr.nix

   1 { pkgs, lib, config, servers, ... }:
   2 let
   3   domain = "sourcephile.fr";
   4   domainID = lib.replaceStrings ["."] ["_"] domain;
   5   credentialsFile = "/var/lib/acme/.lego/${domain}/rfc2136";
   6   inherit (config.users) users groups;
   7 in
   8 {
   9 systemd.services."acme-${domain}".after = [
  10   "unbound.service"
  11 ];
  12 services.shorewall.configs.rules = ''
  13   # for lego to update ACME DNS-01 challenge
  14   DNS(ACCEPT) $FW net:${servers.mermet.ipv4}
  15   # for lego to check DNS propagation on ns6.gandi.net
  16   DNS(ACCEPT) $FW net:217.70.177.40 {user=${users.root.name}}
  17 '';
  18 security.acme.certs."${domain}" = {
  19   email = "root+letsencrypt@${domain}";
  20   extraDomains = {
  21     "*.${domain}" = null;
  22   };
  23   user = users.root.name;
  24   group = groups.acme.name;
  25   allowKeysForGroup = true;
  26   keyType = "rsa4096";
  27   dnsProvider = "rfc2136";
  28   # ns6.gandi.net takes roughly 5min to update
  29   # hence lego's RFC2136_PROPAGATION_TIMEOUT=1000
  30   #dnsPropagationCheck = false;
  31   inherit credentialsFile;
  32 };
  33 install.shellHook = ''
  34   {
  35   cat <<-EOF
  36   RFC2136_NAMESERVER=ns.${domain}:53
  37   RFC2136_TSIG_ALGORITHM=hmac-sha256.
  38   RFC2136_TSIG_KEY=acme_${domainID}
  39   RFC2136_PROPAGATION_TIMEOUT=1000
  40   RFC2136_POLLING_INTERVAL=30
  41   RFC2136_SEQUENCE_INTERVAL=30
  42   RFC2136_DNS_TIMEOUT=1000
  43   RFC2136_TTL=1
  44   EOF
  45   pass "servers/losurdo/lego/${domain}/rfc2136"
  46   } |
  47   ssh "$target" install -D -m 0400 -o root -g root /dev/stdin \
  48    ${credentialsFile}
  49 '';
  50 }