]> Git — Sourcephile - sourcephile-nix.git/blob - hosts/losurdo/acme/sourcephile.fr.nix
mermet: pleroma
[sourcephile-nix.git] / hosts / losurdo / acme / sourcephile.fr.nix
1 { pkgs, lib, config, inputs, hosts, hostName, info, ... }:
2 let
3 domain = "sourcephile.fr";
4 domainID = lib.replaceStrings [ "." ] [ "_" ] domain;
5 inherit (config.users) groups;
6 in
7 {
8 networking.nftables.ruleset = ''
9 table inet filter {
10 # ACME DNS-01 challenge and Gandi DNS
11 set output-net-lego-ipv4 {
12 type ipv4_addr
13 elements = {
14 ${hosts.mermet._module.args.ipv4},
15 ${info.gandi.dns.secondary.ns.ipv4}
16 }
17 }
18 set output-net-lego-ipv6 {
19 type ipv6_addr
20 elements = {
21 ${info.gandi.dns.secondary.ns.ipv6}
22 }
23 }
24 }
25 '';
26 security.acme.certs."${domain}" = {
27 email = "root+letsencrypt@${domain}";
28 extraDomainNames = [
29 "*.${domain}"
30 ];
31 group = groups.acme.name;
32 keyType = "rsa4096";
33 dnsProvider = "rfc2136";
34 # ns6.gandi.net takes roughly 5min to update
35 # hence lego's RFC2136_PROPAGATION_TIMEOUT=1000
36 #dnsPropagationCheck = false;
37 credentialsFile = pkgs.writeText "acme-credentials-${domain}" ''
38 RFC2136_NAMESERVER=ns.${domain}:53
39 RFC2136_TSIG_ALGORITHM=hmac-sha256.
40 RFC2136_TSIG_KEY=acme_${domainID}
41 RFC2136_PROPAGATION_TIMEOUT=1000
42 RFC2136_POLLING_INTERVAL=30
43 RFC2136_SEQUENCE_INTERVAL=30
44 RFC2136_DNS_TIMEOUT=1000
45 RFC2136_TTL=1
46 '';
47 };
48 systemd.services."acme-${domain}" = {
49 serviceConfig.LoadCredentialEncrypted = [
50 "${domain}.tsig:${./. + "/${domain}.tsig.cred"}"
51 ];
52 environment.RFC2136_TSIG_SECRET_FILE = "%d/${domain}.tsig";
53 after = [ "unbound.service" ];
54 };
55 }