]> Git — Sourcephile - sourcephile-nix.git/blob - hosts/losurdo/acme/autogeree.net.nix
private: remove
[sourcephile-nix.git] / hosts / losurdo / acme / autogeree.net.nix
1 { pkgs, lib, config, inputs, hosts, hostName, ... }:
2 let
3 domain = "autogeree.net";
4 domainID = lib.replaceStrings ["."] ["_"] domain;
5 inherit (config.users) groups;
6 in
7 {
8 networking.nftables.ruleset = ''
9 table inet filter {
10 # ACME DNS-01 challenge and Gandi DNS
11 set output-net-lego-ipv4 {
12 type ipv4_addr
13 elements = {
14 ${hosts.mermet._module.args.ipv4},
15 217.70.177.40
16 }
17 }
18 set output-net-lego-ipv6 {
19 type ipv6_addr
20 elements = {
21 2001:4b98:d:1::40
22 }
23 }
24 }
25 '';
26 security.acme.certs."${domain}" = {
27 email = "root+letsencrypt@${domain}";
28 extraDomainNames = [
29 "*.${domain}"
30 ];
31 group = groups.acme.name;
32 keyType = "rsa4096";
33 dnsProvider = "rfc2136";
34 # ns6.gandi.net takes roughly 5min to update
35 # hence lego's RFC2136_PROPAGATION_TIMEOUT=1000
36 #dnsPropagationCheck = false;
37 credentialsFile = "/dev/null";
38 validMinDays = 10;
39 };
40 systemd.services."acme-${domain}" = {
41 serviceConfig.LoadCredentialEncrypted =
42 [ "${domain}.tsig:${inputs.self}/hosts/${hostName}/acme/${domain}.tsig.cred" ];
43 environment = {
44 RFC2136_TSIG_SECRET = "%d/${domain}.tsig";
45 RFC2136_NAMESERVER = "ns.${domain}:53";
46 RFC2136_TSIG_ALGORITHM = "hmac-sha256.";
47 RFC2136_TSIG_KEY = "acme_${domainID}";
48 RFC2136_PROPAGATION_TIMEOUT = "1000";
49 RFC2136_POLLING_INTERVAL = "30";
50 RFC2136_SEQUENCE_INTERVAL = "30";
51 RFC2136_DNS_TIMEOUT = "1000";
52 RFC2136_TTL = "1";
53 };
54 after = [ "unbound.service" ];
55 };
56 }