servers/losurdo/acme/sourcephile.fr.nix

   1 { pkgs, lib, config, servers, ... }:
   2 let
   3   domain = "sourcephile.fr";
   4   domainID = lib.replaceStrings ["."] ["_"] domain;
   5   inherit (config) install;
   6   inherit (config.security) pass;
   7   inherit (config.users) users groups;
   8 in
   9 {
  10 networking.nftables.ruleset = ''
  11   # for lego to update ACME DNS-01 challenge
  12   add rule inet filter fw2net tcp dport 53 ip daddr ${servers.mermet.ipv4} counter accept comment "ACME DNS-01"
  13   add rule inet filter fw2net udp dport 53 ip daddr ${servers.mermet.ipv4} counter accept comment "ACME DNS-01"
  14   # for lego to check DNS propagation on ns6.gandi.net
  15   add rule inet filter fw2net ip daddr 217.70.177.40 tcp dport 53 skuid ${users.root.name} counter accept comment "DNS gandi"
  16   add rule inet filter fw2net ip daddr 217.70.177.40 udp dport 53 skuid ${users.root.name} counter accept comment "DNS gandi"
  17 '';
  18 security.acme.certs."${domain}" = {
  19   email = "root+letsencrypt@${domain}";
  20   extraDomains = {
  21     "*.${domain}" = null;
  22   };
  23   user = users.root.name;
  24   group = groups.acme.name;
  25   allowKeysForGroup = true;
  26   keyType = "rsa4096";
  27   dnsProvider = "rfc2136";
  28   # ns6.gandi.net takes roughly 5min to update
  29   # hence lego's RFC2136_PROPAGATION_TIMEOUT=1000
  30   #dnsPropagationCheck = false;
  31   credentialsFile = pass.secrets."lego/${domain}/rfc2136".path;
  32 };
  33 security.pass.secrets."lego/${domain}/rfc2136" = {
  34   pipe = ''
  35     cat - ${pkgs.writeText "env" ''
  36     RFC2136_NAMESERVER=ns.${domain}:53
  37     RFC2136_TSIG_ALGORITHM=hmac-sha256.
  38     RFC2136_TSIG_KEY=acme_${domainID}
  39     RFC2136_PROPAGATION_TIMEOUT=1000
  40     RFC2136_POLLING_INTERVAL=30
  41     RFC2136_SEQUENCE_INTERVAL=30
  42     RFC2136_DNS_TIMEOUT=1000
  43     RFC2136_TTL=1
  44     ''}
  45   '';
  46 };
  47 systemd.services."acme-${domain}" = {
  48   after = [
  49     "unbound.service"
  50     pass.secrets."lego/${domain}/rfc2136".service
  51   ];
  52   wants = [
  53     "unbound.service"
  54     pass.secrets."lego/${domain}/rfc2136".service
  55   ];
  56 };
  57 }