hosts/losurdo/acme/autogeree.net.nix

   1 { pkgs, lib, config, hosts, ... }:
   2 let
   3   domain = "autogeree.net";
   4   domainID = lib.replaceStrings ["."] ["_"] domain;
   5   inherit (config.security) gnupg;
   6   inherit (config.users) users groups;
   7 in
   8 {
   9 networking.nftables.ruleset = ''
  10   table inet filter {
  11     # ACME DNS-01 challenge and Gandi DNS
  12     set output-net-lego-ipv4 {
  13       type ipv4_addr
  14       elements = {
  15         ${hosts.mermet._module.args.ipv4},
  16         217.70.177.40
  17       }
  18     }
  19     set output-net-lego-ipv6 {
  20       type ipv6_addr
  21       elements = {
  22         2001:4b98:d:1::40
  23       }
  24     }
  25   }
  26 '';
  27 security.acme.certs."${domain}" = {
  28   email = "root+letsencrypt@${domain}";
  29   extraDomainNames = [
  30     "*.${domain}"
  31   ];
  32   group = groups.acme.name;
  33   keyType = "rsa4096";
  34   dnsProvider = "rfc2136";
  35   # ns6.gandi.net takes roughly 5min to update
  36   # hence lego's RFC2136_PROPAGATION_TIMEOUT=1000
  37   #dnsPropagationCheck = false;
  38   credentialsFile = gnupg.secrets."lego/${domain}/rfc2136".path;
  39 };
  40 security.gnupg.secrets."lego/${domain}/rfc2136" = {
  41   pipe = ''
  42     cat - ${pkgs.writeText "env" ''
  43     RFC2136_NAMESERVER=ns.${domain}:53
  44     RFC2136_TSIG_ALGORITHM=hmac-sha256.
  45     RFC2136_TSIG_KEY=acme_${domainID}
  46     RFC2136_PROPAGATION_TIMEOUT=1000
  47     RFC2136_POLLING_INTERVAL=30
  48     RFC2136_SEQUENCE_INTERVAL=30
  49     RFC2136_DNS_TIMEOUT=1000
  50     RFC2136_TTL=1
  51     ''}
  52   '';
  53 };
  54 systemd.services."acme-${domain}" = {
  55   after = [
  56     "unbound.service"
  57     gnupg.secrets."lego/${domain}/rfc2136".service
  58   ];
  59   wants = [
  60     "unbound.service"
  61     gnupg.secrets."lego/${domain}/rfc2136".service
  62   ];
  63 };
  64 }