hosting/selfhostblocks
1
0
Fork 0
Code Issues Activity

add host provider for ssl letsencrypt block

Browse source
This commit is contained in:
ibizaman 2024-08-11 04:49:38 +02:00 committed by Pierre Penninckx
parent aed62d3553
commit 6b17ff858e
1 changed files with 36 additions and 13 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

31
modules/blocks/ssl.nix
View file

@ -238,6 +238,7 @@ in
additionalEnvironment = lib.mkOption { additionalEnvironment = lib.mkOption {
type = lib.types.attrsOf lib.types.str; type = lib.types.attrsOf lib.types.str;
default = {};
description = '' description = ''
Additional environment variables used to configure the DNS provider. Additional environment variables used to configure the DNS provider.
@ -267,6 +268,12 @@ in
type = lib.types.str; type = lib.types.str;
}; };
stagingServer = lib.mkOption {
description = "User Let's Encrypt's staging server.";
type = lib.types.bool;
default = false;
};
debug = lib.mkOption { debug = lib.mkOption {
description = "Enable debug logging"; description = "Enable debug logging";
type = lib.types.bool; type = lib.types.bool;
@ -415,18 +422,34 @@ in
security.acme.acceptTerms = lib.mkIf (cfg.certs.letsencrypt != {}) true; security.acme.acceptTerms = lib.mkIf (cfg.certs.letsencrypt != {}) true;
security.acme.certs = lib.mkMerge (lib.mapAttrsToList (name: certCfg: { security.acme.certs = lib.mkMerge (lib.mapAttrsToList (name: certCfg:
"${name}" = { {
"${name}" = ({
extraDomainNames = [ certCfg.domain ] ++ certCfg.extraDomains; extraDomainNames = [ certCfg.domain ] ++ certCfg.extraDomains;
email = certCfg.adminEmail; email = certCfg.adminEmail;
enableDebugLogs = certCfg.debug;
server = lib.mkIf certCfg.stagingServer "https://acme-staging-v02.api.letsencrypt.org/directory";
} // lib.optionalAttrs (certCfg.dnsProvider != null) {
inherit (certCfg) dnsProvider dnsResolver; inherit (certCfg) dnsProvider dnsResolver;
inherit (certCfg) group reloadServices; inherit (certCfg) group reloadServices;
credentialsFile = certCfg.credentialsFile; credentialsFile = certCfg.credentialsFile;
enableDebugLogs = certCfg.debug; });
}) cfg.certs.letsencrypt);
services.nginx = lib.mkMerge (lib.mapAttrsToList (name: certCfg:
lib.optionalAttrs (certCfg.dnsProvider == null) {
virtualHosts."${name}" = {
addSSL = true;
enableACME = true;
serverAliases = certCfg.extraDomains;
# locations."/" = {
# root = "/var/www";
# };
}; };
}) cfg.certs.letsencrypt); }) cfg.certs.letsencrypt);
systemd.services = lib.mkMerge (lib.mapAttrsToList (name: certCfg: { systemd.services = lib.mkMerge (lib.mapAttrsToList (name: certCfg:
lib.optionalAttrs (certCfg.additionalEnvironment != {}) {
"acme-${certCfg.domain}".environment = certCfg.additionalEnvironment; "acme-${certCfg.domain}".environment = certCfg.additionalEnvironment;
}) cfg.certs.letsencrypt); }) cfg.certs.letsencrypt);
} }