hosts/losurdo/acme/sourcephile.fr.nix

   1 { pkgs, lib, config, hosts, credentials, ... }:
   2 let
   3   domain = "sourcephile.fr";
   4   domainID = lib.replaceStrings ["."] ["_"] domain;
   5   inherit (config.users) groups;
   6 in
   7 {
   8 networking.nftables.ruleset = ''
   9   table inet filter {
  10     # ACME DNS-01 challenge and Gandi DNS
  11     set output-net-lego-ipv4 {
  12       type ipv4_addr
  13       elements = {
  14         ${hosts.mermet._module.args.ipv4},
  15         217.70.177.40
  16       }
  17     }
  18     set output-net-lego-ipv6 {
  19       type ipv6_addr
  20       elements = { 2001:4b98:d:1::40 }
  21     }
  22   }
  23 '';
  24 security.acme.certs."${domain}" = {
  25   email = "root+letsencrypt@${domain}";
  26   extraDomainNames = [
  27     "*.${domain}"
  28   ];
  29   group = groups.acme.name;
  30   keyType = "rsa4096";
  31   dnsProvider = "rfc2136";
  32   # ns6.gandi.net takes roughly 5min to update
  33   # hence lego's RFC2136_PROPAGATION_TIMEOUT=1000
  34   #dnsPropagationCheck = false;
  35   credentialsFile = "/dev/null";
  36 };
  37 systemd.services."acme-${domain}" = {
  38   serviceConfig.LoadCredentialEncrypted = "${domain}.tsig:${credentials}/acme/${domain}.tsig.secret";
  39   environment = {
  40     RFC2136_TSIG_SECRET = "%d/${domain}.tsig";
  41     RFC2136_NAMESERVER = "ns.${domain}:53";
  42     RFC2136_TSIG_ALGORITHM = "hmac-sha256.";
  43     RFC2136_TSIG_KEY = "acme_${domainID}";
  44     RFC2136_PROPAGATION_TIMEOUT = "1000";
  45     RFC2136_POLLING_INTERVAL = "30";
  46     RFC2136_SEQUENCE_INTERVAL = "30";
  47     RFC2136_DNS_TIMEOUT = "1000";
  48     RFC2136_TTL = "1";
  49   };
  50   after = [ "unbound.service" ];
  51 };
  52 }