all repos — nixfiles @ 0deb085c8fd582166a39e01656c2933974d74acd

System and user configuration, managed by nix and home-manager

move acme defaults to caddy configuration

Alin
commit

0deb085c8fd582166a39e01656c2933974d74acd

parent

1e7faab27c8b81cc690c83d439f894d0108acf61

1 file changed, 22 insertions(+), 2 deletions(-)

changed files
M system/settings/services/caddy.nix → system/settings/services/caddy.nix
@@ -4,15 +4,35 @@ lib,
   ...
 }:
 {
-  services.tailscale.permitCertUid = config.services.caddy.user;
+  age.secrets = {
+    acme.file = ../../../secrets/acme.age;
+  };
 
-  security.acme.defaults.reloadServices = [ "caddy" ];
   users.groups.acme.members = [ "caddy" ];
 
+  security.acme = {
+    defaults = {
+      reloadServices = [ "caddy" ];
+
+      environmentFile = config.age.secrets.acme.path;
+      server = "https://acme-api.actalis.com/acme/directory";
+      extraLegoFlags = [ "--eab" ]; # environmentFile must contain LEGO_EAB_KID and LEGO_EAB_HMAC
+    };
+    acceptTerms = true;
+  };
+
   services.caddy = {
     enable = true;
     openFirewall = true;
     group = "caddy";
+    email = config.security.acme.defaults.email;
+    acmeCA = config.security.acme.defaults.server;
+    globalConfig = ''
+      acme_eab {
+        key_id {$EAB_KEY_ID}
+        mac_key {$EAB_MAC_KEY}
+      }
+    '';
     virtualHosts = {
       "http://" = {
         # Needed for HTTP->HTTPS servers