hosts/losurdo/acme/sourcephile.fr.nix

   1 { pkgs, lib, config, inputs, hosts, hostName, ... }:
   2 let
   3   domain = "sourcephile.fr";
   4   domainID = lib.replaceStrings [ "." ] [ "_" ] domain;
   5   inherit (config.users) groups;
   6 in
   7 {
   8   networking.nftables.ruleset = ''
   9     table inet filter {
  10       # ACME DNS-01 challenge and Gandi DNS
  11       set output-net-lego-ipv4 {
  12         type ipv4_addr
  13         elements = {
  14           ${hosts.mermet._module.args.ipv4},
  15           217.70.177.40
  16         }
  17       }
  18       set output-net-lego-ipv6 {
  19         type ipv6_addr
  20         elements = { 2001:4b98:d:1::40 }
  21       }
  22     }
  23   '';
  24   security.acme.certs."${domain}" = {
  25     email = "root+letsencrypt@${domain}";
  26     extraDomainNames = [
  27       "*.${domain}"
  28     ];
  29     group = groups.acme.name;
  30     keyType = "rsa4096";
  31     dnsProvider = "rfc2136";
  32     # ns6.gandi.net takes roughly 5min to update
  33     # hence lego's RFC2136_PROPAGATION_TIMEOUT=1000
  34     #dnsPropagationCheck = false;
  35     credentialsFile = pkgs.writeText "acme-credentials-${domain}" ''
  36       RFC2136_NAMESERVER=ns.${domain}:53
  37       RFC2136_TSIG_ALGORITHM=hmac-sha256.
  38       RFC2136_TSIG_KEY=acme_${domainID}
  39       RFC2136_PROPAGATION_TIMEOUT=1000
  40       RFC2136_POLLING_INTERVAL=30
  41       RFC2136_SEQUENCE_INTERVAL=30
  42       RFC2136_DNS_TIMEOUT=1000
  43       RFC2136_TTL=1
  44     '';
  45   };
  46   systemd.services."acme-${domain}" = {
  47     serviceConfig.LoadCredentialEncrypted = [
  48       "${domain}.tsig:${./. + "/${domain}.tsig.cred"}"
  49     ];
  50     environment.RFC2136_TSIG_SECRET_FILE = "%d/${domain}.tsig";
  51     after = [ "unbound.service" ];
  52   };
  53 }