servers/losurdo/acme/autogeree.net.nix

   1 { pkgs, lib, config, servers, ... }:
   2 let
   3   domain = "autogeree.net";
   4   domainID = lib.replaceStrings ["."] ["_"] domain;
   5   credentialsFile = "/var/lib/acme/.lego/${domain}/rfc2136";
   6   inherit (config.users) users groups;
   7 in
   8 {
   9 systemd.services."acme-${domain}".after = [
  10   "unbound.service"
  11 ];
  12 networking.nftables.ruleset = ''
  13   # for lego to update ACME DNS-01 challenge
  14   add rule inet filter fw2net ip daddr ${servers.mermet.ipv4} tcp dport 53 counter accept comment "DNS"
  15   add rule inet filter fw2net ip daddr ${servers.mermet.ipv4} udp dport 53 counter accept comment "DNS"
  16   # for lego to check DNS propagation on ns6.gandi.net
  17   add rule inet filter fw2net ip daddr 217.70.177.40 tcp dport 53 skuid ${users.root.name} counter accept comment "DNS gandi"
  18   add rule inet filter fw2net ip daddr 217.70.177.40 udp dport 53 skuid ${users.root.name} counter accept comment "DNS gandi"
  19   # for lego to check DNS propagation on ns0.muarf.org
  20   add rule inet filter fw2net ip daddr 78.192.65.63 tcp dport 53 skuid ${users.root.name} counter accept comment "DNS muarf"
  21   add rule inet filter fw2net ip daddr 78.192.65.63 udp dport 53 skuid ${users.root.name} counter accept comment "DNS muarf"
  22 '';
  23 security.acme.certs."${domain}" = {
  24   email = "root+letsencrypt@${domain}";
  25   extraDomains = {
  26     "*.${domain}" = null;
  27   };
  28   user = users.root.name;
  29   group = groups.acme.name;
  30   allowKeysForGroup = true;
  31   keyType = "rsa4096";
  32   dnsProvider = "rfc2136";
  33   # ns6.gandi.net takes roughly 5min to update
  34   # hence lego's RFC2136_PROPAGATION_TIMEOUT=1000
  35   #dnsPropagationCheck = false;
  36   inherit credentialsFile;
  37 };
  38 security.install.shellHook = ''
  39   {
  40   cat <<-EOF
  41   RFC2136_NAMESERVER=ns.${domain}:53
  42   RFC2136_TSIG_ALGORITHM=hmac-sha256.
  43   RFC2136_TSIG_KEY=acme_${domainID}
  44   RFC2136_PROPAGATION_TIMEOUT=1000
  45   RFC2136_POLLING_INTERVAL=30
  46   RFC2136_SEQUENCE_INTERVAL=30
  47   RFC2136_DNS_TIMEOUT=1000
  48   RFC2136_TTL=1
  49   EOF
  50   pass "servers/losurdo/lego/${domain}/rfc2136"
  51   } |
  52   ssh "$target" install -D -m 0400 -o root -g root /dev/stdin \
  53    ${credentialsFile}
  54 '';
  55 }