Add given password for hosts/mermet/knot/autogeree.net/lebureau.conf to store.

[sourcephile-nix.git] / hosts / mermet / acme.nix

diff --git a/hosts/mermet/acme.nix b/hosts/mermet/acme.nix
index 311bdb49c2f65050780cb0c715e6862ceb1a8a3b..df9328d84e2bc8e55b85425db208483a5ea26504 100644 (file)
--- a/hosts/mermet/acme.nix
+++ b/hosts/mermet/acme.nix
@@ -1,16 +1,37 @@
-{ pkgs, lib, config, ... }:
+{ pkgs, config, ... }:
+let
+  inherit (config.users) users;
+in
 {
-imports = [
-  acme/autogeree.net.nix
-  acme/sourcephile.fr.nix
-];
-security.acme = {
-  acceptTerms = true;
-};
-environment.systemPackages = [
-  pkgs.lego
-];
-users.groups = {
-  acme = {};
-};
+  imports = [
+    acme/autogeree.net.nix
+    acme/sourcephile.fr.nix
+  ];
+  networking.nftables.ruleset = ''
+    table inet filter {
+      set output-net-lego-ipv4 { type ipv4_addr; }
+      set output-net-lego-ipv6 { type ipv6_addr; }
+      chain output-net {
+        skuid ${users.acme.name} \
+          meta l4proto { udp, tcp } th dport domain \
+          ip daddr @output-net-lego-ipv4 \
+          counter accept \
+          comment "lego: DNS"
+        skuid ${users.acme.name} \
+          meta l4proto { udp, tcp } th dport domain \
+          ip6 daddr @output-net-lego-ipv6 \
+          counter accept \
+          comment "lego: DNS"
+      }
+    }
+  '';
+  security.acme = {
+    acceptTerms = true;
+  };
+  environment.systemPackages = [
+    pkgs.lego
+  ];
+  users.groups = {
+    acme = { };
+  };
 }