all repos — nixfiles @ 3a9dbd383cd569abaa10f6348cd942d90997c5f1

System and user configuration, managed by nix and home-manager

local-ca: allow provisioning certs with IP address subjects

Alin
commit

3a9dbd383cd569abaa10f6348cd942d90997c5f1

parent

50c21877dc2515e2eeae20049baac08e03b9f3ef

1 file changed, 17 insertions(+), 5 deletions(-)

changed files
M system/roles/webserver/local-ca.nix → system/roles/webserver/local-ca.nix
@@ -4,6 +4,7 @@ ...
 }:
 let
   inherit (config.networking) domain fqdn;
+  inherit (import ../../../data) ulaPrefix;
 in
 {
   security.pki.certificateFiles = [

@@ -31,11 +32,6 @@ }
         '';
       };
       "acme.${domain}" = {
-        # cd /var/lib/caddy && install -D -m 444 .local/share/caddy/pki/authorities/home/root.crt ca/root.crt
-        serverAliases = [
-          "ca.${domain}"
-          "http://ca.${domain}"
-        ];
         extraConfig = ''
           tls {
             issuer internal {

@@ -46,8 +42,24 @@ acme_server {
             ca home
             allow {
               domains *.test *.${domain}
+              ip_ranges 10.0.0.0/8 ${ulaPrefix}::/48 fe80::/16
             }
           }
+        '';
+      };
+      "ca.${domain}" = {
+        # cd /var/lib/caddy && install -D -m 444 .local/share/caddy/pki/authorities/home/root.crt ca/root.crt
+        serverAliases = [
+          "ca.${domain}"
+          "http://ca.${domain}"
+        ];
+        extraConfig = ''
+          tls {
+            issuer internal {
+              ca home
+            }
+          }
+
           root /var/lib/caddy/ca
           file_server browse
         '';