all repos — nixfiles @ 0e21f39bebf7bd649e05e9785dec14ca27eb4692

System and user configuration, managed by nix and home-manager

extract acme configuration to reverse-proxy role

Alin
commit

0e21f39bebf7bd649e05e9785dec14ca27eb4692

parent

4a94984718a95c35b80eba4b875e7f9f75826928

1 file changed, 10 insertions(+), 0 deletions(-)

changed files
M system/roles/reverse-proxy.nix → system/roles/reverse-proxy.nix
@@ -8,10 +8,20 @@ imports = [
     ../settings/configuration/nur.nix
   ];
   age.secrets = {
+    acme.file = ../../secrets/acme.age;
     # TS_AUTHKEY for caddy-tailscale plugin
     caddy.file = ../../secrets/caddy.age;
   };
 
+  security.acme = {
+    defaults = {
+      email = "security@${config.networking.domain}";
+      dnsProvider = "pdns";
+      credentialsFile = config.age.secrets.acme.path;
+      validMinDays = 32;
+    };
+    acceptTerms = true;
+  };
 
   services.caddy = {
     environmentFile = config.age.secrets.caddy.path;