machines/mermet/acme/autogeree.net.nix

   1 { pkgs, lib, config, ... }:
   2 let
   3   domain = "autogeree.net";
   4   inherit (config.users) users groups;
   5 in
   6 {
   7 networking.nftables.ruleset = ''
   8   # for lego to check DNS propagation on ns6.gandi.net
   9   add rule inet filter fw2net ip daddr 217.70.177.40 tcp dport 53 skuid ${users.acme.name} counter accept comment "DNS gandi"
  10   add rule inet filter fw2net ip daddr 217.70.177.40 udp dport 53 skuid ${users.acme.name} counter accept comment "DNS gandi"
  11   add rule inet filter fw2net ip6 daddr 2001:4b98:d:1::40 tcp dport 53 skuid ${users.acme.name} counter accept comment "DNS gandi"
  12   add rule inet filter fw2net ip6 daddr 2001:4b98:d:1::40 udp dport 53 skuid ${users.acme.name} counter accept comment "DNS gandi"
  13   # for lego to check DNS propagation on ns0.muarf.org
  14   add rule inet filter fw2net ip daddr 78.192.65.63 tcp dport 53 skuid ${users.acme.name} counter accept comment "DNS muarf"
  15   add rule inet filter fw2net ip daddr 78.192.65.63 udp dport 53 skuid ${users.acme.name} counter accept comment "DNS muarf"
  16 '';
  17 systemd.services."acme-${domain}".after = [
  18   "unbound.service"
  19 ];
  20 security.acme.certs."${domain}" = {
  21   email = "root+letsencrypt@${domain}";
  22   extraDomainNames = [
  23     "*.${domain}"
  24   ];
  25   group = groups."acme".name;
  26   keyType = "rsa4096";
  27   dnsProvider = "rfc2136";
  28   credentialsFile = pkgs.writeText "credentials" ''
  29     RFC2136_NAMESERVER=127.0.0.1:5353
  30     RFC2136_PROPAGATION_TIMEOUT=1000
  31     RFC2136_POLLING_INTERVAL=30
  32     RFC2136_SEQUENCE_INTERVAL=30
  33     RFC2136_DNS_TIMEOUT=1000
  34     RFC2136_TTL=1
  35   '';
  36 };
  37 }