{ pkgs, lib, config, servers, ... }: let domain = "autogeree.net"; domainID = lib.replaceStrings ["."] ["_"] domain; credentialsFile = "/var/lib/acme/.lego/${domain}/rfc2136"; inherit (config.users) users groups; in { systemd.services."acme-${domain}".after = [ "unbound.service" ]; services.shorewall.configs.rules = '' # for lego to update ACME DNS-01 challenge DNS(ACCEPT) $FW net:${servers.mermet.ipv4} # for lego to check DNS propagation on ns6.gandi.net DNS(ACCEPT) $FW net:217.70.177.40 {user=${users.root.name}} # for lego to check DNS propagation on ns0.muarf.org DNS(ACCEPT) $FW net:78.192.65.63 {user=${users.root.name}} ''; security.acme.certs."${domain}" = { email = "root+letsencrypt@${domain}"; extraDomains = { "*.${domain}" = null; }; user = users.root.name; group = groups.acme.name; allowKeysForGroup = true; keyType = "rsa4096"; dnsProvider = "rfc2136"; # ns6.gandi.net takes roughly 5min to update # hence lego's RFC2136_PROPAGATION_TIMEOUT=1000 #dnsPropagationCheck = false; inherit credentialsFile; }; install.shellHook = '' { cat <<-EOF RFC2136_NAMESERVER=ns.${domain}:53 RFC2136_TSIG_ALGORITHM=hmac-sha256. RFC2136_TSIG_KEY=acme_${domainID} RFC2136_PROPAGATION_TIMEOUT=1000 RFC2136_POLLING_INTERVAL=30 RFC2136_SEQUENCE_INTERVAL=30 RFC2136_DNS_TIMEOUT=1000 RFC2136_TTL=1 EOF pass "servers/losurdo/lego/${domain}/rfc2136" } | ssh "$target" install -D -m 0400 -o root -g root /dev/stdin \ ${credentialsFile} ''; }