all repos — nixfiles @ 0e21f39bebf7bd649e05e9785dec14ca27eb4692

System and user configuration, managed by nix and home-manager

extract acme configuration to reverse-proxy role

Alin
commit

0e21f39bebf7bd649e05e9785dec14ca27eb4692

parent

4a94984718a95c35b80eba4b875e7f9f75826928

2 files changed, 10 insertions(+), 8 deletions(-)

changed files
M system/hosts/linde.nix → system/hosts/linde.nix
@@ -46,7 +46,6 @@ owner = cfg.user;
         mode = "400";
         symlink = false;
       };
-    acme.file = ../../secrets/acme.age;
     binarycache.file = ../../secrets/binarycache.age;
     powerdns.file = ../../secrets/powerdns.age;
     redis-website.file = ../../secrets/redis-website.age;

@@ -522,13 +521,6 @@ };
   };
 
   security.acme = {
-    defaults = {
-      inherit email;
-      dnsProvider = "pdns";
-      credentialsFile = config.age.secrets.acme.path;
-      validMinDays = 32;
-    };
-    acceptTerms = true;
     certs."${oldDomain}" = {
       extraDomainNames = [ "*.${oldDomain}" ];
     };
M system/roles/reverse-proxy.nix → system/roles/reverse-proxy.nix
@@ -8,10 +8,20 @@ imports = [
     ../settings/configuration/nur.nix
   ];
   age.secrets = {
+    acme.file = ../../secrets/acme.age;
     # TS_AUTHKEY for caddy-tailscale plugin
     caddy.file = ../../secrets/caddy.age;
   };
 
+  security.acme = {
+    defaults = {
+      email = "security@${config.networking.domain}";
+      dnsProvider = "pdns";
+      credentialsFile = config.age.secrets.acme.path;
+      validMinDays = 32;
+    };
+    acceptTerms = true;
+  };
 
   services.caddy = {
     environmentFile = config.age.secrets.caddy.path;