]> Git — Sourcephile - sourcephile-nix.git/blob - hosts/losurdo/acme/sourcephile.fr.nix
private: remove
[sourcephile-nix.git] / hosts / losurdo / acme / sourcephile.fr.nix
1 { pkgs, lib, config, inputs, hosts, hostName, ... }:
2 let
3 domain = "sourcephile.fr";
4 domainID = lib.replaceStrings ["."] ["_"] domain;
5 inherit (config.users) groups;
6 in
7 {
8 networking.nftables.ruleset = ''
9 table inet filter {
10 # ACME DNS-01 challenge and Gandi DNS
11 set output-net-lego-ipv4 {
12 type ipv4_addr
13 elements = {
14 ${hosts.mermet._module.args.ipv4},
15 217.70.177.40
16 }
17 }
18 set output-net-lego-ipv6 {
19 type ipv6_addr
20 elements = { 2001:4b98:d:1::40 }
21 }
22 }
23 '';
24 security.acme.certs."${domain}" = {
25 email = "root+letsencrypt@${domain}";
26 extraDomainNames = [
27 "*.${domain}"
28 ];
29 group = groups.acme.name;
30 keyType = "rsa4096";
31 dnsProvider = "rfc2136";
32 # ns6.gandi.net takes roughly 5min to update
33 # hence lego's RFC2136_PROPAGATION_TIMEOUT=1000
34 #dnsPropagationCheck = false;
35 credentialsFile = "/dev/null";
36 };
37 systemd.services."acme-${domain}" = {
38 serviceConfig.LoadCredentialEncrypted =
39 [ "${domain}.tsig:${inputs.self}/hosts/${hostName}/acme/${domain}.tsig.cred" ];
40 environment = {
41 RFC2136_TSIG_SECRET = "%d/${domain}.tsig";
42 RFC2136_NAMESERVER = "ns.${domain}:53";
43 RFC2136_TSIG_ALGORITHM = "hmac-sha256.";
44 RFC2136_TSIG_KEY = "acme_${domainID}";
45 RFC2136_PROPAGATION_TIMEOUT = "1000";
46 RFC2136_POLLING_INTERVAL = "30";
47 RFC2136_SEQUENCE_INTERVAL = "30";
48 RFC2136_DNS_TIMEOUT = "1000";
49 RFC2136_TTL = "1";
50 };
51 after = [ "unbound.service" ];
52 };
53 }