all repos — nixfiles @ 0deb085c8fd582166a39e01656c2933974d74acd

System and user configuration, managed by nix and home-manager

move acme defaults to caddy configuration

Alin
commit

0deb085c8fd582166a39e01656c2933974d74acd

parent

1e7faab27c8b81cc690c83d439f894d0108acf61

2 files changed, 30 insertions(+), 24 deletions(-)

changed files
M system/roles/reverse-proxy.nix → system/roles/reverse-proxy.nix
@@ -8,25 +8,17 @@ imports = [
     ../settings/services/caddy.nix
   ];
   age.secrets = {
-    acme.file = ../../secrets/acme.age;
     # TS_AUTHKEY for caddy-tailscale plugin
     caddy.file = ../../secrets/caddy.age;
   };
 
-  security.acme = {
-    defaults = {
-      email = "security@${config.networking.domain}";
-      dnsProvider = "pdns";
-      validMinDays = 32;
-
-      environmentFile = config.age.secrets.acme.path;
-
-      server = "https://acme-api.actalis.com/acme/directory";
-      extraLegoFlags = [ "--eab" ]; # environmentFile must contain LEGO_EAB_KID and LEGO_EAB_HMAC
-    };
-    acceptTerms = true;
+  security.acme.defaults = {
+    email = "security@${config.networking.domain}";
+    dnsProvider = "pdns";
+    validMinDays = 32;
   };
 
+  services.tailscale.permitCertUid = config.services.caddy.user;
   services.caddy = {
     environmentFile = config.age.secrets.caddy.path;
     package = pkgs.caddy.withPlugins {

@@ -38,8 +30,6 @@ "github.com/caddy-dns/rfc2136@v1.0.0"
       ];
       hash = "sha256-SzD72CcYhIMvmgteHI4gyhEU41gExSMEzm1GvxE2ZQY=";
     };
-    email = config.security.acme.defaults.email;
-    acmeCA = config.security.acme.defaults.server;
     globalConfig = ''
       cache
       servers {

@@ -63,10 +53,6 @@ key_alg hmac-sha512
         key "{env.DDNS_TSIG_KEY}"
         server [::1]:53
       }
-      acme_eab {
-        key_id {$EAB_KEY_ID}
-        mac_key {$EAB_MAC_KEY}
-      }
     '';
   };
 

@@ -109,10 +95,10 @@ "net.ipv4.tcp_rmem" = "4096 87380 ${toString buffer_size}";
       "net.ipv4.tcp_wmem" = "4096 87380 ${toString buffer_size}";
       "net.ipv4.tcp_mem" = "${mem} ${mem} ${mem}";
 
-      "net.ipv4.tcp_sack" = false;
-      "net.ipv4.tcp_dsack" = false;
+      "net.ipv4.tcp_sack" = 0;
+      "net.ipv4.tcp_dsack" = 0;
 
-      "net.ipv4.tcp_slow_start_after_idle" = false;
+      "net.ipv4.tcp_slow_start_after_idle" = 0;
     };
 
 }
M system/settings/services/caddy.nix → system/settings/services/caddy.nix
@@ -4,15 +4,35 @@ lib,
   ...
 }:
 {
-  services.tailscale.permitCertUid = config.services.caddy.user;
+  age.secrets = {
+    acme.file = ../../../secrets/acme.age;
+  };
 
-  security.acme.defaults.reloadServices = [ "caddy" ];
   users.groups.acme.members = [ "caddy" ];
 
+  security.acme = {
+    defaults = {
+      reloadServices = [ "caddy" ];
+
+      environmentFile = config.age.secrets.acme.path;
+      server = "https://acme-api.actalis.com/acme/directory";
+      extraLegoFlags = [ "--eab" ]; # environmentFile must contain LEGO_EAB_KID and LEGO_EAB_HMAC
+    };
+    acceptTerms = true;
+  };
+
   services.caddy = {
     enable = true;
     openFirewall = true;
     group = "caddy";
+    email = config.security.acme.defaults.email;
+    acmeCA = config.security.acme.defaults.server;
+    globalConfig = ''
+      acme_eab {
+        key_id {$EAB_KEY_ID}
+        mac_key {$EAB_MAC_KEY}
+      }
+    '';
     virtualHosts = {
       "http://" = {
         # Needed for HTTP->HTTPS servers