Merge pull request 'Certificate reliability enchansements'

Reviewed-on: ilchub/selfprivacy-nixos-infect#3

nixos-infect

@@ -48,6 +48,7 @@ makeConf() {
     ./social/pleroma-module.nix
     ./social/pleroma.nix
     ./letsencrypt/acme.nix
+    ./letsencrypt/resolve.nix
     ./backup/restic.nix
     ./passmgr/bitwarden.nix
     ./webserver/nginx.nix
@@ -127,7 +128,10 @@ EOF
 {
   imports = [ <nixpkgs/nixos/modules/profiles/qemu-guest.nix> ];
   boot.loader.grub.device = "$grubdev";
-  fileSystems."/" = { device = "$rootfsdev"; fsType = "ext4"; };
+  fileSystems = {
+    "/" = { device = "$rootfsdev"; fsType = "ext4"; };
+    "/var" = { device = "/dev/sdb"; fsType = "ext4" };
+  };
 }
 EOF
 
@@ -251,6 +255,27 @@ EOF
     };
   };
 }
+EOF
+    cat > /etc/nixos/letsencrypt/resolve.nix << EOF
+{ pkgs, ... }:
+{
+  systemd = {
+    services = {
+      "acme-$DOMAIN" = {
+        serviceConfig = {
+          StartLimitBurst = 5;
+          StartLimitIntervalSec = 5;
+          Restart = "on-failure";
+        };
+      };
+      "nginx-config-reload" = {
+        serviceConfig = {
+          After = [ "acme-$DOMAIN.service" ];
+        };
+      };
+    };
+  };
+}
 EOF
 
     cat > /etc/nixos/backup/restic.nix << EOF
@@ -308,6 +333,7 @@ EOF
 {
   services.nginx = {
     enable = true;
+    enableReload = true;
     recommendedGzipSettings = true;
     recommendedOptimisation = true;
     recommendedProxySettings = true;