SelfPrivacy
/
selfprivacy-nixos-config
6
3
Fork 6
Code Issues 19 Pull Requests 1 Projects Releases Wiki Activity

Revert "use enableACME for all virtualHosts" 

This reverts commit 46366702bc.
pull/55/head
Alexander 2023-12-19 23:46:42 +04:00
parent 46366702bc
commit c18f332f5f
10 changed files with 30 additions and 12 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
letsencrypt/acme.nix
View File

@ -25,8 +25,15 @@ in
dnsPropagationCheck =
! (lib.elem cfg.dns.provider dnsPropagationCheckExceptions);
reloadServices = [ "nginx" ];
dnsProvider = lib.strings.toLower cfg.dns.provider;
credentialsFile = acme-env-filepath;
};
certs = lib.mkForce {
"${cfg.domain}" = {
domain = "*.${cfg.domain}";
extraDomainNames = [ "${cfg.domain}" ];
group = "acmereceivers";
dnsProvider = lib.strings.toLower cfg.dns.provider;
credentialsFile = acme-env-filepath;
};
};
};
systemd.services.acme-secrets = {

3
sp-modules/bitwarden/module.nix
View File

@ -72,8 +72,9 @@ in
'';
};
services.nginx.virtualHosts."password.${sp.domain}" = {
sslCertificate = "/var/lib/acme/${sp.domain}/fullchain.pem";
sslCertificateKey = "/var/lib/acme/${sp.domain}/key.pem";
forceSSL = true;
enableACME = true;
extraConfig = ''
add_header Strict-Transport-Security $hsts_header;
#add_header Content-Security-Policy "script-src 'self'; object-src 'none'; base-uri 'none';" always;

3
sp-modules/gitea/module.nix
View File

@ -85,8 +85,9 @@ in
};
};
services.nginx.virtualHosts."git.${sp.domain}" = {
sslCertificate = "/var/lib/acme/${sp.domain}/fullchain.pem";
sslCertificateKey = "/var/lib/acme/${sp.domain}/key.pem";
forceSSL = true;
enableACME = true;
extraConfig = ''
add_header Strict-Transport-Security $hsts_header;
#add_header Content-Security-Policy "script-src 'self'; object-src 'none'; base-uri 'none';" always;

5
sp-modules/jitsi-meet/module.nix
View File

@ -21,8 +21,11 @@ in
};
};
services.nginx.virtualHosts."meet.${domain}" = {
sslCertificate = "/var/lib/acme/${domain}/fullchain.pem";
sslCertificateKey = "/var/lib/acme/${domain}/key.pem";
forceSSL = true;
enableACME = true;
useACMEHost = domain;
enableACME = false;
};
};
}

3
sp-modules/nextcloud/module.nix
View File

@ -69,8 +69,9 @@
};
};
services.nginx.virtualHosts.${hostName} = {
sslCertificate = "/var/lib/acme/${sp.domain}/fullchain.pem";
sslCertificateKey = "/var/lib/acme/${sp.domain}/key.pem";
forceSSL = true;
enableACME = true;
extraConfig = ''
add_header Strict-Transport-Security $hsts_header;
#add_header Content-Security-Policy "script-src 'self'; object-src 'none'; base-uri 'none';" always;

3
sp-modules/ocserv/module.nix
View File

@ -56,8 +56,9 @@ in
'';
};
services.nginx.virtualHosts."vpn.${domain}" = {
sslCertificate = "/var/lib/acme/${domain}/fullchain.pem";
sslCertificateKey = "/var/lib/acme/${domain}/key.pem";
forceSSL = true;
enableACME = true;
extraConfig = ''
add_header Strict-Transport-Security $hsts_header;
#add_header Content-Security-Policy "script-src 'self'; object-src 'none'; base-uri 'none';" always;

3
sp-modules/pleroma/module.nix
View File

@ -100,9 +100,10 @@ in
# seems to be an upstream nixpkgs/nixos bug (missing hexdump)
systemd.services.pleroma.path = [ pkgs.util-linux ];
services.nginx.virtualHosts."social.${sp.domain}" = {
sslCertificate = "/var/lib/acme/${sp.domain}/fullchain.pem";
sslCertificateKey = "/var/lib/acme/${sp.domain}/key.pem";
root = "/var/www/social.${sp.domain}";
forceSSL = true;
enableACME = true;
extraConfig = ''
add_header Strict-Transport-Security $hsts_header;
#add_header Content-Security-Policy "script-src 'self'; object-src 'none'; base-uri 'none';" always;

1
sp-modules/simple-nixos-mailserver/config-paths-needed.json
View File

@ -11,6 +11,5 @@
[ "services", "postfix", "user" ],
[ "services", "redis" ],
[ "services", "rspamd" ],
[ "security", "acme", "certs" ],
[ "selfprivacy", "modules", "simple-nixos-mailserver" ]
]

4
sp-modules/simple-nixos-mailserver/config.nix
View File

@ -66,7 +66,9 @@ lib.mkIf sp.modules.simple-nixos-mailserver.enable
"admin@${sp.domain}" = "${sp.username}@${sp.domain}";
};
certificateScheme = "acme";
certificateScheme = "manual";
certificateFile = "/var/lib/acme/${sp.domain}/fullchain.pem";
keyFile = "/var/lib/acme/${sp.domain}/key.pem";
# Enable IMAP and POP3
enableImap = true;

6
webserver/nginx.nix
View File

@ -21,8 +21,9 @@ in
'';
virtualHosts = {
"${domain}" = {
sslCertificate = "/var/lib/acme/${domain}/fullchain.pem";
sslCertificateKey = "/var/lib/acme/${domain}/key.pem";
forceSSL = true;
enableACME = true;
extraConfig = ''
add_header Strict-Transport-Security $hsts_header;
#add_header Content-Security-Policy "script-src 'self'; object-src 'none'; base-uri 'none';" always;
@ -40,8 +41,9 @@ in
};
};
"api.${domain}" = {
sslCertificate = "/var/lib/acme/${domain}/fullchain.pem";
sslCertificateKey = "/var/lib/acme/${domain}/key.pem";
forceSSL = true;
enableACME = true;
extraConfig = ''
add_header Strict-Transport-Security $hsts_header;
#add_header Content-Security-Policy "script-src 'self'; object-src 'none'; base-uri 'none';" always;