all repos — nixfiles @ 249b47b87c477b9ab90f714a6a7526c6ab184e6a

System and user configuration, managed by nix and home-manager

use web-challenge-based certificate provisioning DNS-based challenges are broken at the moment due to some problem sending update notifications to secondary DNS servers

Alin
commit

249b47b87c477b9ab90f714a6a7526c6ab184e6a

parent

548fb3218f0d71a009111ded8994f2d6036f96bd

2 files changed, 11 insertions(+), 1 deletion(-)

changed files
M system/roles/redis-website.nix → system/roles/redis-website.nix
@@ -30,7 +30,18 @@ };
     };
   };
 
+  services.caddy.virtualHosts = {
+    "http://redis.${domain}" = {
+      extraConfig = ''
+        reverse_proxy /.well-known/acme-challenge/* {
+          to ${config.security.acme.certs."redis.${domain}".listenHTTP}
+        }
+      '';
+    };
+  };
+
   security.acme.certs."redis.${domain}" = {
+    listenHTTP = "[::1]:1360";
     group = "redis-website";
     reloadServices = [ "redis-website" ];
   };
M system/roles/webserver/reverse-proxy.nix → system/roles/webserver/reverse-proxy.nix
@@ -14,7 +14,6 @@ };
 
   security.acme.defaults = {
     email = "security@${config.networking.domain}";
-    dnsProvider = "pdns";
     validMinDays = 32;
   };