machines/losurdo/acme/autogeree.net.nix

   1 { pkgs, lib, config, machines, ... }:
   2 let
   3   domain = "autogeree.net";
   4   domainID = lib.replaceStrings ["."] ["_"] domain;
   5   inherit (config.security) gnupg;
   6   inherit (config.users) users groups;
   7 in
   8 {
   9 networking.nftables.ruleset = ''
  10   # for lego to update ACME DNS-01 challenge
  11   add rule inet filter fw2net ip daddr ${machines.mermet.extraArgs.ipv4} tcp dport 53 counter accept comment "ACME DNS-01"
  12   add rule inet filter fw2net ip daddr ${machines.mermet.extraArgs.ipv4} udp dport 53 counter accept comment "ACME DNS-01"
  13   # for lego to check DNS propagation on ns6.gandi.net
  14   add rule inet filter fw2net ip daddr 217.70.177.40 tcp dport 53 skuid ${users.acme.name} counter accept comment "DNS gandi"
  15   add rule inet filter fw2net ip daddr 217.70.177.40 udp dport 53 skuid ${users.acme.name} counter accept comment "DNS gandi"
  16   add rule inet filter fw2net ip6 daddr 2001:4b98:d:1::40 tcp dport 53 skuid ${users.acme.name} counter accept comment "DNS gandi"
  17   add rule inet filter fw2net ip6 daddr 2001:4b98:d:1::40 udp dport 53 skuid ${users.acme.name} counter accept comment "DNS gandi"
  18   # for lego to check DNS propagation on ns0.muarf.org
  19   add rule inet filter fw2net ip daddr 78.192.65.63 tcp dport 53 skuid ${users.acme.name} counter accept comment "DNS muarf"
  20   add rule inet filter fw2net ip daddr 78.192.65.63 udp dport 53 skuid ${users.acme.name} counter accept comment "DNS muarf"
  21 '';
  22 security.acme.certs."${domain}" = {
  23   email = "root+letsencrypt@${domain}";
  24   extraDomainNames = [
  25     "*.${domain}"
  26   ];
  27   group = groups.acme.name;
  28   keyType = "rsa4096";
  29   dnsProvider = "rfc2136";
  30   # ns6.gandi.net takes roughly 5min to update
  31   # hence lego's RFC2136_PROPAGATION_TIMEOUT=1000
  32   #dnsPropagationCheck = false;
  33   credentialsFile = gnupg.secrets."lego/${domain}/rfc2136".path;
  34 };
  35 security.gnupg.secrets."lego/${domain}/rfc2136" = {
  36   pipe = ''
  37     cat - ${pkgs.writeText "env" ''
  38     RFC2136_NAMESERVER=ns.${domain}:53
  39     RFC2136_TSIG_ALGORITHM=hmac-sha256.
  40     RFC2136_TSIG_KEY=acme_${domainID}
  41     RFC2136_PROPAGATION_TIMEOUT=1000
  42     RFC2136_POLLING_INTERVAL=30
  43     RFC2136_SEQUENCE_INTERVAL=30
  44     RFC2136_DNS_TIMEOUT=1000
  45     RFC2136_TTL=1
  46     ''}
  47   '';
  48 };
  49 systemd.services."acme-${domain}" = {
  50   after = [
  51     "unbound.service"
  52     gnupg.secrets."lego/${domain}/rfc2136".service
  53   ];
  54   wants = [
  55     "unbound.service"
  56     gnupg.secrets."lego/${domain}/rfc2136".service
  57   ];
  58 };
  59 }