servers/mermet/acme/sourcephile.fr.nix

   1 { pkgs, lib, config, ... }:
   2 let
   3   domain = "sourcephile.fr";
   4   inherit (config.users) users groups;
   5 in
   6 {
   7 networking.nftables.ruleset = ''
   8   # for lego to check DNS propagation on ns6.gandi.net
   9   add rule inet filter fw2net ip daddr 217.70.177.40 tcp dport 53 skuid ${users.root.name} counter accept comment "DNS gandi"
  10   add rule inet filter fw2net ip daddr 217.70.177.40 udp dport 53 skuid ${users.root.name} counter accept comment "DNS gandi"
  11 '';
  12 systemd.services."acme-${domain}".after = [
  13   "unbound.service"
  14 ];
  15 security.acme.certs."${domain}" = {
  16   email = "root@${domain}";
  17   extraDomains = {
  18     "*.${domain}" = null;
  19   };
  20   group = groups."acme".name;
  21   allowKeysForGroup = true;
  22   keyType = "rsa4096";
  23   dnsProvider = "rfc2136";
  24   credentialsFile = pkgs.writeText "credentials" ''
  25     RFC2136_NAMESERVER=127.0.0.1:5353
  26     RFC2136_PROPAGATION_TIMEOUT=1000
  27     RFC2136_POLLING_INTERVAL=30
  28     RFC2136_SEQUENCE_INTERVAL=30
  29     RFC2136_DNS_TIMEOUT=1000
  30     RFC2136_TTL=1
  31   '';
  32 };
  33 }