]> Git — Sourcephile - sourcephile-nix.git/blob - servers/losurdo/acme/sourcephile.fr.nix
postgresql: fix pg_adduser
[sourcephile-nix.git] / servers / losurdo / acme / sourcephile.fr.nix
1 { pkgs, lib, config, servers, ... }:
2 let
3 domain = "sourcephile.fr";
4 domainID = lib.replaceStrings ["."] ["_"] domain;
5 credentialsFile = "/var/lib/acme/.lego/${domain}/rfc2136";
6 inherit (config.users) users groups;
7 in
8 {
9 systemd.services."acme-${domain}".after = [
10 "unbound.service"
11 ];
12 networking.nftables.ruleset = ''
13 # for lego to update ACME DNS-01 challenge
14 add rule inet filter fw2net tcp dport 53 ip daddr ${servers.mermet.ipv4} counter accept comment "DNS"
15 add rule inet filter fw2net udp dport 53 ip daddr ${servers.mermet.ipv4} counter accept comment "DNS"
16 # for lego to check DNS propagation on ns6.gandi.net
17 add rule inet filter fw2net ip daddr 217.70.177.40 tcp dport 53 skuid ${users.root.name} counter accept comment "DNS gandi"
18 add rule inet filter fw2net ip daddr 217.70.177.40 udp dport 53 skuid ${users.root.name} counter accept comment "DNS gandi"
19 '';
20 security.acme.certs."${domain}" = {
21 email = "root+letsencrypt@${domain}";
22 extraDomains = {
23 "*.${domain}" = null;
24 };
25 user = users.root.name;
26 group = groups.acme.name;
27 allowKeysForGroup = true;
28 keyType = "rsa4096";
29 dnsProvider = "rfc2136";
30 # ns6.gandi.net takes roughly 5min to update
31 # hence lego's RFC2136_PROPAGATION_TIMEOUT=1000
32 #dnsPropagationCheck = false;
33 inherit credentialsFile;
34 };
35 security.install.shellHook = ''
36 {
37 cat <<-EOF
38 RFC2136_NAMESERVER=ns.${domain}:53
39 RFC2136_TSIG_ALGORITHM=hmac-sha256.
40 RFC2136_TSIG_KEY=acme_${domainID}
41 RFC2136_PROPAGATION_TIMEOUT=1000
42 RFC2136_POLLING_INTERVAL=30
43 RFC2136_SEQUENCE_INTERVAL=30
44 RFC2136_DNS_TIMEOUT=1000
45 RFC2136_TTL=1
46 EOF
47 pass "servers/losurdo/lego/${domain}/rfc2136"
48 } |
49 ssh "$target" install -D -m 0400 -o root -g root /dev/stdin \
50 ${credentialsFile}
51 '';
52 }