all repos — nixfiles @ dae4a1a0c4fb6e75c450e1f59013ff5cae30064c

System and user configuration, managed by nix and home-manager

reverse-proxy: use EU-issued ACME TLS certificate issuer

Alin
commit

dae4a1a0c4fb6e75c450e1f59013ff5cae30064c

parent

a2be03c08c0f6abee661e0484a1c9f353b5e1681

1 file changed, 11 insertions(+), 1 deletion(-)

changed files
M system/roles/reverse-proxy.nix → system/roles/reverse-proxy.nix
@@ -18,8 +18,12 @@ security.acme = {
     defaults = {
       email = "security@${config.networking.domain}";
       dnsProvider = "pdns";
-      credentialsFile = config.age.secrets.acme.path;
       validMinDays = 32;
+
+      environmentFile = config.age.secrets.acme.path;
+
+      server = "https://acme-api.actalis.com/acme/directory";
+      extraLegoFlags = [ "--eab" ]; # environmentFile must contain LEGO_EAB_KID and LEGO_EAB_HMAC
     };
     acceptTerms = true;
   };

@@ -35,6 +39,8 @@ "github.com/caddy-dns/rfc2136@v1.0.0"
       ];
       hash = "sha256-SzD72CcYhIMvmgteHI4gyhEU41gExSMEzm1GvxE2ZQY=";
     };
+    email = config.security.acme.defaults.email;
+    acmeCA = config.security.acme.defaults.server;
     globalConfig = ''
       cache
       servers {

@@ -57,6 +63,10 @@ key_name caddy
         key_alg hmac-sha512
         key "{env.DDNS_TSIG_KEY}"
         server [::1]:53
+      }
+      acme_eab {
+        key_id {$EAB_KEY_ID}
+        mac_key {$EAB_MAC_KEY}
       }
     '';
   };