From c18f332f5fbc9531b71fc48c48477106e9b73970 Mon Sep 17 00:00:00 2001 From: Alexander Tomokhov Date: Tue, 19 Dec 2023 23:46:42 +0400 Subject: [PATCH] Revert "use enableACME for all virtualHosts" This reverts commit 46366702bc6fe1352588f8db7f1ca58b1cfb0a84. --- letsencrypt/acme.nix | 11 +++++++++-- sp-modules/bitwarden/module.nix | 3 ++- sp-modules/gitea/module.nix | 3 ++- sp-modules/jitsi-meet/module.nix | 5 ++++- sp-modules/nextcloud/module.nix | 3 ++- sp-modules/ocserv/module.nix | 3 ++- sp-modules/pleroma/module.nix | 3 ++- .../simple-nixos-mailserver/config-paths-needed.json | 1 - sp-modules/simple-nixos-mailserver/config.nix | 4 +++- webserver/nginx.nix | 6 ++++-- 10 files changed, 30 insertions(+), 12 deletions(-) diff --git a/letsencrypt/acme.nix b/letsencrypt/acme.nix index 22702f0..b01b6f2 100644 --- a/letsencrypt/acme.nix +++ b/letsencrypt/acme.nix @@ -25,8 +25,15 @@ in dnsPropagationCheck = ! (lib.elem cfg.dns.provider dnsPropagationCheckExceptions); reloadServices = [ "nginx" ]; - dnsProvider = lib.strings.toLower cfg.dns.provider; - credentialsFile = acme-env-filepath; + }; + certs = lib.mkForce { + "${cfg.domain}" = { + domain = "*.${cfg.domain}"; + extraDomainNames = [ "${cfg.domain}" ]; + group = "acmereceivers"; + dnsProvider = lib.strings.toLower cfg.dns.provider; + credentialsFile = acme-env-filepath; + }; }; }; systemd.services.acme-secrets = { diff --git a/sp-modules/bitwarden/module.nix b/sp-modules/bitwarden/module.nix index b1b510a..d7a50cf 100644 --- a/sp-modules/bitwarden/module.nix +++ b/sp-modules/bitwarden/module.nix @@ -72,8 +72,9 @@ in ''; }; services.nginx.virtualHosts."password.${sp.domain}" = { + sslCertificate = "/var/lib/acme/${sp.domain}/fullchain.pem"; + sslCertificateKey = "/var/lib/acme/${sp.domain}/key.pem"; forceSSL = true; - enableACME = true; extraConfig = '' add_header Strict-Transport-Security $hsts_header; #add_header Content-Security-Policy "script-src 'self'; object-src 'none'; base-uri 'none';" always; diff --git a/sp-modules/gitea/module.nix b/sp-modules/gitea/module.nix index 7b7cbdf..5023f8d 100644 --- a/sp-modules/gitea/module.nix +++ b/sp-modules/gitea/module.nix @@ -85,8 +85,9 @@ in }; }; services.nginx.virtualHosts."git.${sp.domain}" = { + sslCertificate = "/var/lib/acme/${sp.domain}/fullchain.pem"; + sslCertificateKey = "/var/lib/acme/${sp.domain}/key.pem"; forceSSL = true; - enableACME = true; extraConfig = '' add_header Strict-Transport-Security $hsts_header; #add_header Content-Security-Policy "script-src 'self'; object-src 'none'; base-uri 'none';" always; diff --git a/sp-modules/jitsi-meet/module.nix b/sp-modules/jitsi-meet/module.nix index 2fedc99..d23207a 100644 --- a/sp-modules/jitsi-meet/module.nix +++ b/sp-modules/jitsi-meet/module.nix @@ -21,8 +21,11 @@ in }; }; services.nginx.virtualHosts."meet.${domain}" = { + sslCertificate = "/var/lib/acme/${domain}/fullchain.pem"; + sslCertificateKey = "/var/lib/acme/${domain}/key.pem"; forceSSL = true; - enableACME = true; + useACMEHost = domain; + enableACME = false; }; }; } diff --git a/sp-modules/nextcloud/module.nix b/sp-modules/nextcloud/module.nix index 35633e7..3b4a183 100644 --- a/sp-modules/nextcloud/module.nix +++ b/sp-modules/nextcloud/module.nix @@ -69,8 +69,9 @@ }; }; services.nginx.virtualHosts.${hostName} = { + sslCertificate = "/var/lib/acme/${sp.domain}/fullchain.pem"; + sslCertificateKey = "/var/lib/acme/${sp.domain}/key.pem"; forceSSL = true; - enableACME = true; extraConfig = '' add_header Strict-Transport-Security $hsts_header; #add_header Content-Security-Policy "script-src 'self'; object-src 'none'; base-uri 'none';" always; diff --git a/sp-modules/ocserv/module.nix b/sp-modules/ocserv/module.nix index 4d3bd34..d33369a 100644 --- a/sp-modules/ocserv/module.nix +++ b/sp-modules/ocserv/module.nix @@ -56,8 +56,9 @@ in ''; }; services.nginx.virtualHosts."vpn.${domain}" = { + sslCertificate = "/var/lib/acme/${domain}/fullchain.pem"; + sslCertificateKey = "/var/lib/acme/${domain}/key.pem"; forceSSL = true; - enableACME = true; extraConfig = '' add_header Strict-Transport-Security $hsts_header; #add_header Content-Security-Policy "script-src 'self'; object-src 'none'; base-uri 'none';" always; diff --git a/sp-modules/pleroma/module.nix b/sp-modules/pleroma/module.nix index 0296ad4..afb2969 100644 --- a/sp-modules/pleroma/module.nix +++ b/sp-modules/pleroma/module.nix @@ -100,9 +100,10 @@ in # seems to be an upstream nixpkgs/nixos bug (missing hexdump) systemd.services.pleroma.path = [ pkgs.util-linux ]; services.nginx.virtualHosts."social.${sp.domain}" = { + sslCertificate = "/var/lib/acme/${sp.domain}/fullchain.pem"; + sslCertificateKey = "/var/lib/acme/${sp.domain}/key.pem"; root = "/var/www/social.${sp.domain}"; forceSSL = true; - enableACME = true; extraConfig = '' add_header Strict-Transport-Security $hsts_header; #add_header Content-Security-Policy "script-src 'self'; object-src 'none'; base-uri 'none';" always; diff --git a/sp-modules/simple-nixos-mailserver/config-paths-needed.json b/sp-modules/simple-nixos-mailserver/config-paths-needed.json index 88475b9..27c44ff 100644 --- a/sp-modules/simple-nixos-mailserver/config-paths-needed.json +++ b/sp-modules/simple-nixos-mailserver/config-paths-needed.json @@ -11,6 +11,5 @@ [ "services", "postfix", "user" ], [ "services", "redis" ], [ "services", "rspamd" ], - [ "security", "acme", "certs" ], [ "selfprivacy", "modules", "simple-nixos-mailserver" ] ] diff --git a/sp-modules/simple-nixos-mailserver/config.nix b/sp-modules/simple-nixos-mailserver/config.nix index f6fc53b..3ac1145 100644 --- a/sp-modules/simple-nixos-mailserver/config.nix +++ b/sp-modules/simple-nixos-mailserver/config.nix @@ -66,7 +66,9 @@ lib.mkIf sp.modules.simple-nixos-mailserver.enable "admin@${sp.domain}" = "${sp.username}@${sp.domain}"; }; - certificateScheme = "acme"; + certificateScheme = "manual"; + certificateFile = "/var/lib/acme/${sp.domain}/fullchain.pem"; + keyFile = "/var/lib/acme/${sp.domain}/key.pem"; # Enable IMAP and POP3 enableImap = true; diff --git a/webserver/nginx.nix b/webserver/nginx.nix index 8b97c38..03320db 100644 --- a/webserver/nginx.nix +++ b/webserver/nginx.nix @@ -21,8 +21,9 @@ in ''; virtualHosts = { "${domain}" = { + sslCertificate = "/var/lib/acme/${domain}/fullchain.pem"; + sslCertificateKey = "/var/lib/acme/${domain}/key.pem"; forceSSL = true; - enableACME = true; extraConfig = '' add_header Strict-Transport-Security $hsts_header; #add_header Content-Security-Policy "script-src 'self'; object-src 'none'; base-uri 'none';" always; @@ -40,8 +41,9 @@ in }; }; "api.${domain}" = { + sslCertificate = "/var/lib/acme/${domain}/fullchain.pem"; + sslCertificateKey = "/var/lib/acme/${domain}/key.pem"; forceSSL = true; - enableACME = true; extraConfig = '' add_header Strict-Transport-Security $hsts_header; #add_header Content-Security-Policy "script-src 'self'; object-src 'none'; base-uri 'none';" always;