]> Git — Sourcephile - sourcephile-nix.git/blob - machines/losurdo/acme/autogeree.net.nix
nix: fix PASSWORD_STORE_DIR
[sourcephile-nix.git] / machines / losurdo / acme / autogeree.net.nix
1 { pkgs, lib, config, machines, ... }:
2 let
3 domain = "autogeree.net";
4 domainID = lib.replaceStrings ["."] ["_"] domain;
5 inherit (config.security) gnupg;
6 inherit (config.users) users groups;
7 in
8 {
9 networking.nftables.ruleset = ''
10 # for lego to update ACME DNS-01 challenge
11 add rule inet filter fw2net ip daddr ${machines.mermet.extraArgs.ipv4} tcp dport 53 counter accept comment "ACME DNS-01"
12 add rule inet filter fw2net ip daddr ${machines.mermet.extraArgs.ipv4} udp dport 53 counter accept comment "ACME DNS-01"
13 # for lego to check DNS propagation on ns6.gandi.net
14 add rule inet filter fw2net ip daddr 217.70.177.40 tcp dport 53 skuid ${users.acme.name} counter accept comment "DNS gandi"
15 add rule inet filter fw2net ip daddr 217.70.177.40 udp dport 53 skuid ${users.acme.name} counter accept comment "DNS gandi"
16 add rule inet filter fw2net ip6 daddr 2001:4b98:d:1::40 tcp dport 53 skuid ${users.acme.name} counter accept comment "DNS gandi"
17 add rule inet filter fw2net ip6 daddr 2001:4b98:d:1::40 udp dport 53 skuid ${users.acme.name} counter accept comment "DNS gandi"
18 # for lego to check DNS propagation on ns0.muarf.org
19 add rule inet filter fw2net ip daddr 78.192.65.63 tcp dport 53 skuid ${users.acme.name} counter accept comment "DNS muarf"
20 add rule inet filter fw2net ip daddr 78.192.65.63 udp dport 53 skuid ${users.acme.name} counter accept comment "DNS muarf"
21 '';
22 security.acme.certs."${domain}" = {
23 email = "root+letsencrypt@${domain}";
24 extraDomainNames = [
25 "*.${domain}"
26 ];
27 group = groups.acme.name;
28 keyType = "rsa4096";
29 dnsProvider = "rfc2136";
30 # ns6.gandi.net takes roughly 5min to update
31 # hence lego's RFC2136_PROPAGATION_TIMEOUT=1000
32 #dnsPropagationCheck = false;
33 credentialsFile = gnupg.secrets."lego/${domain}/rfc2136".path;
34 };
35 security.gnupg.secrets."lego/${domain}/rfc2136" = {
36 pipe = ''
37 cat - ${pkgs.writeText "env" ''
38 RFC2136_NAMESERVER=ns.${domain}:53
39 RFC2136_TSIG_ALGORITHM=hmac-sha256.
40 RFC2136_TSIG_KEY=acme_${domainID}
41 RFC2136_PROPAGATION_TIMEOUT=1000
42 RFC2136_POLLING_INTERVAL=30
43 RFC2136_SEQUENCE_INTERVAL=30
44 RFC2136_DNS_TIMEOUT=1000
45 RFC2136_TTL=1
46 ''}
47 '';
48 };
49 systemd.services."acme-${domain}" = {
50 after = [
51 "unbound.service"
52 gnupg.secrets."lego/${domain}/rfc2136".service
53 ];
54 wants = [
55 "unbound.service"
56 gnupg.secrets."lego/${domain}/rfc2136".service
57 ];
58 };
59 }