hosts/losurdo/acme/autogeree.net.nix

   1 { pkgs, lib, config, hosts, credentials, ... }:
   2 let
   3   domain = "autogeree.net";
   4   domainID = lib.replaceStrings ["."] ["_"] domain;
   5   inherit (config.users) groups;
   6 in
   7 {
   8 networking.nftables.ruleset = ''
   9   table inet filter {
  10     # ACME DNS-01 challenge and Gandi DNS
  11     set output-net-lego-ipv4 {
  12       type ipv4_addr
  13       elements = {
  14         ${hosts.mermet._module.args.ipv4},
  15         217.70.177.40
  16       }
  17     }
  18     set output-net-lego-ipv6 {
  19       type ipv6_addr
  20       elements = {
  21         2001:4b98:d:1::40
  22       }
  23     }
  24   }
  25 '';
  26 security.acme.certs."${domain}" = {
  27   email = "root+letsencrypt@${domain}";
  28   extraDomainNames = [
  29     "*.${domain}"
  30   ];
  31   group = groups.acme.name;
  32   keyType = "rsa4096";
  33   dnsProvider = "rfc2136";
  34   # ns6.gandi.net takes roughly 5min to update
  35   # hence lego's RFC2136_PROPAGATION_TIMEOUT=1000
  36   #dnsPropagationCheck = false;
  37   credentialsFile = "/dev/null";
  38   validMinDays = 10;
  39 };
  40 systemd.services."acme-${domain}" = {
  41   serviceConfig.LoadCredentialEncrypted = "${domain}.tsig:${credentials}/acme/${domain}.tsig.secret";
  42   environment = {
  43     RFC2136_TSIG_SECRET = "%d/${domain}.tsig";
  44     RFC2136_NAMESERVER = "ns.${domain}:53";
  45     RFC2136_TSIG_ALGORITHM = "hmac-sha256.";
  46     RFC2136_TSIG_KEY = "acme_${domainID}";
  47     RFC2136_PROPAGATION_TIMEOUT = "1000";
  48     RFC2136_POLLING_INTERVAL = "30";
  49     RFC2136_SEQUENCE_INTERVAL = "30";
  50     RFC2136_DNS_TIMEOUT = "1000";
  51     RFC2136_TTL = "1";
  52   };
  53   after = [ "unbound.service" ];
  54 };
  55 }