diff options
author | sefidel <contact@sefidel.net> | 2023-02-02 18:48:45 +0900 |
---|---|---|
committer | sefidel <contact@sefidel.net> | 2023-02-02 18:58:09 +0900 |
commit | 68e5d83b0b379fdca677cbd3221fa05fe5ec268f (patch) | |
tree | 9cf212cedc1b36da8366331581dc156efd39e559 /colmena/cobalt/services/acme.nix | |
parent | c551a417940f9c66b4346c5813c2550f06269380 (diff) | |
download | nixrc-68e5d83b0b379fdca677cbd3221fa05fe5ec268f.tar.gz nixrc-68e5d83b0b379fdca677cbd3221fa05fe5ec268f.zip |
feat(colmena/cobalt): configure soju & acme
Diffstat (limited to 'colmena/cobalt/services/acme.nix')
-rw-r--r-- | colmena/cobalt/services/acme.nix | 26 |
1 files changed, 26 insertions, 0 deletions
diff --git a/colmena/cobalt/services/acme.nix b/colmena/cobalt/services/acme.nix new file mode 100644 index 0000000..b41ae1c --- /dev/null +++ b/colmena/cobalt/services/acme.nix @@ -0,0 +1,26 @@ +let + poorObfuscation = y: x: "${x}@${y}"; +in +{ + security.acme = { + acceptTerms = true; + defaults.email = poorObfuscation "sefidel.com" "postmaster"; + certs = { + "sefidel.com" = { + domain = "*.sefidel.com"; + dnsProvider = "hetzner"; + dnsPropagationCheck = true; + credentialsFile = "/persist/secrets/hetzner.key"; + }; + }; + }; + + environment.persistence."/persist".directories = [ + "/var/lib/acme" + ]; + + deployment.keys."hetzner.key" = { + keyCommand = [ "pass" "show" "server/hetzner-dns" ]; + destDir = "/persist/secrets"; + }; +} |