]> Git — Sourcephile - sourcephile-nix.git/blob - servers/losurdo/acme/sourcephile.fr.nix
nix: fix install and security.pass
[sourcephile-nix.git] / servers / losurdo / acme / sourcephile.fr.nix
1 { pkgs, lib, config, servers, ... }:
2 let
3 domain = "sourcephile.fr";
4 domainID = lib.replaceStrings ["."] ["_"] domain;
5 inherit (config) install;
6 inherit (config.security) pass;
7 inherit (config.users) users groups;
8 in
9 {
10 networking.nftables.ruleset = ''
11 # for lego to update ACME DNS-01 challenge
12 add rule inet filter fw2net tcp dport 53 ip daddr ${servers.mermet.ipv4} counter accept comment "ACME DNS-01"
13 add rule inet filter fw2net udp dport 53 ip daddr ${servers.mermet.ipv4} counter accept comment "ACME DNS-01"
14 # for lego to check DNS propagation on ns6.gandi.net
15 add rule inet filter fw2net ip daddr 217.70.177.40 tcp dport 53 skuid ${users.root.name} counter accept comment "DNS gandi"
16 add rule inet filter fw2net ip daddr 217.70.177.40 udp dport 53 skuid ${users.root.name} counter accept comment "DNS gandi"
17 '';
18 security.acme.certs."${domain}" = {
19 email = "root+letsencrypt@${domain}";
20 extraDomains = {
21 "*.${domain}" = null;
22 };
23 user = users.root.name;
24 group = groups.acme.name;
25 allowKeysForGroup = true;
26 keyType = "rsa4096";
27 dnsProvider = "rfc2136";
28 # ns6.gandi.net takes roughly 5min to update
29 # hence lego's RFC2136_PROPAGATION_TIMEOUT=1000
30 #dnsPropagationCheck = false;
31 credentialsFile = pass.secrets."lego/${domain}/rfc2136".path;
32 };
33 security.pass.secrets."lego/${domain}/rfc2136" = {
34 pipe = ''
35 cat - ${pkgs.writeText "env" ''
36 RFC2136_NAMESERVER=ns.${domain}:53
37 RFC2136_TSIG_ALGORITHM=hmac-sha256.
38 RFC2136_TSIG_KEY=acme_${domainID}
39 RFC2136_PROPAGATION_TIMEOUT=1000
40 RFC2136_POLLING_INTERVAL=30
41 RFC2136_SEQUENCE_INTERVAL=30
42 RFC2136_DNS_TIMEOUT=1000
43 RFC2136_TTL=1
44 ''}
45 '';
46 };
47 systemd.services."acme-${domain}" = {
48 after = [
49 "unbound.service"
50 pass.secrets."lego/${domain}/rfc2136".service
51 ];
52 wants = [
53 "unbound.service"
54 pass.secrets."lego/${domain}/rfc2136".service
55 ];
56 };
57 }