Not showing binary file.

Not showing binary file.

@@ -31,7 +31,6 @@ ../roles/paperless.nix
     ../roles/searchix.nix
     ../roles/searchix-stable-container.nix
     ../roles/sso.nix
-    ../roles/subdomain-redirector.nix
     ../roles/syncthing.nix
     ../roles/video-library.nix
 

@@ -36,15 +36,17 @@ let
         srv = config.services.goatcounter;
       in
       {
-        useACMEHost = "stats.${domain}";
-        serverAliases = [ "*.stats.${domain}" ];
+        # TODO: switch to on-demand TLS
+        # useACMEHost = "stats.${domain}";
+        # serverAliases = [ "*.stats.${domain}" ];
         extraConfig = ''
           reverse_proxy ${srv.address}:${toString srv.port}
         '';
       };
   };
 
-  security.acme.certs."stats.${domain}" = {
-    extraDomainNames = [ "*.stats.${domain}" ];
-  };
+  ## actalis doesn't allow wildcard on free tier
+  # security.acme.certs."stats.${domain}" = {
+  #   extraDomainNames = [ "*.stats.${domain}" ];
+  # };
 }

@@ -18,8 +18,12 @@ security.acme = {
     defaults = {
       email = "security@${config.networking.domain}";
       dnsProvider = "pdns";
-      credentialsFile = config.age.secrets.acme.path;
       validMinDays = 32;
+
+      environmentFile = config.age.secrets.acme.path;
+
+      server = "https://acme-api.actalis.com/acme/directory";
+      extraLegoFlags = [ "--eab" ]; # environmentFile must contain LEGO_EAB_KID and LEGO_EAB_HMAC
     };
     acceptTerms = true;
   };
@@ -35,6 +39,8 @@ "github.com/caddy-dns/rfc2136@v1.0.0"
       ];
       hash = "sha256-SzD72CcYhIMvmgteHI4gyhEU41gExSMEzm1GvxE2ZQY=";
     };
+    email = config.security.acme.defaults.email;
+    acmeCA = config.security.acme.defaults.server;
     globalConfig = ''
       cache
       servers {
@@ -57,6 +63,10 @@ key_name caddy
         key_alg hmac-sha512
         key "{env.DDNS_TSIG_KEY}"
         server [::1]:53
+      }
+      acme_eab {
+        key_id {$EAB_KEY_ID}
+        mac_key {$EAB_MAC_KEY}
       }
     '';
   };

@@ -1,24 +0,0 @@
-{
-  config,
-  ...
-}:
-let
-  newDomain = config.networking.domain;
-  oldDomain = "alanpearce.eu";
-in
-{
-  security.acme = {
-    certs."${oldDomain}" = {
-      extraDomainNames = [ "*.${oldDomain}" ];
-    };
-  };
-
-  services.caddy.virtualHosts = {
-    "*.${oldDomain}" = {
-      useACMEHost = "${oldDomain}";
-      extraConfig = ''
-        redir https://{labels.2}.${newDomain}{uri}
-      '';
-    };
-  };
-}