lukegb/depot
1
0
Fork 0
Code Issues 1 Pull requests Projects Packages Activity Actions

ops/nixos: tidy up security.acme

Browse source
This commit is contained in:
Luke Granger-Brown 2022-01-04 14:00:45 +00:00
parent de71fd5c9a
commit d79265ddad
12 changed files with 51 additions and 99 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

16
ops/nixos/blade-tuvok/default.nix
View file

@ -77,17 +77,11 @@ in {
};
};
};
security.acme = {
acceptTerms = true;
email = "letsencrypt@lukegb.com";
certs."objdump.zxcvbnm.ninja" = {
group = config.services.nginx.group;
dnsProvider = "cloudflare";
credentialsFile = secrets.cloudflareCredentials;
extraDomainNames = [
"*.objdump.zxcvbnm.ninja"
];
};
security.acme.certs."objdump.zxcvbnm.ninja" = {
group = config.services.nginx.group;
extraDomainNames = [
"*.objdump.zxcvbnm.ninja"
];
};
my.fup.listen = [
"0.0.0.0" "[::]"

12
ops/nixos/bvm-matrix/default.nix
View file

@ -168,15 +168,9 @@ in {
members = [ "turnserver" "nginx" ];
};
security.acme = {
acceptTerms = true;
email = "letsencrypt@lukegb.com";
certs."matrix.zxcvbnm.ninja" = {
group = "matrixcert";
dnsProvider = "cloudflare";
credentialsFile = secrets.cloudflareCredentials;
extraDomainNames = [ "element.zxcvbnm.ninja" "zxcvbnm.ninja" ];
};
security.acme.certs."matrix.zxcvbnm.ninja" = {
group = "matrixcert";
extraDomainNames = [ "element.zxcvbnm.ninja" "zxcvbnm.ninja" ];
};
system.stateVersion = "21.05";

6
ops/nixos/bvm-prosody/default.nix
View file

@ -87,18 +87,12 @@ in {
};
security.acme = {
acceptTerms = true;
email = "letsencrypt@lukegb.com";
certs."xmpp.lukegb.com" = {
group = "prosody";
dnsProvider = "cloudflare";
credentialsFile = secrets.cloudflareCredentials;
extraDomainNames = [ "*.xmpp.lukegb.com" "lukegb.com" ];
};
certs."turn.lukegb.com" = {
group = "turnserver";
dnsProvider = "cloudflare";
credentialsFile = secrets.cloudflareCredentials;
};
};

20
ops/nixos/bvm-radius/default.nix
View file

@ -51,18 +51,14 @@ in {
};
my.ip.tailscale = "100.120.98.116";
security.acme = {
acceptTerms = true;
email = "letsencrypt@lukegb.com";
certs."as205479.net" = {
extraDomainNames = [ "www.as205479.net" ];
dnsProvider = "gcloud";
credentialsFile = secrets.gcpDNSCredentials;
dnsPropagationCheck = false;
postRun = ''
systemctl restart freeradius
'';
};
security.acme.certs."as205479.net" = {
extraDomainNames = [ "www.as205479.net" ];
dnsProvider = "gcloud";
credentialsFile = secrets.gcpDNSCredentials;
dnsPropagationCheck = false;
postRun = ''
systemctl restart freeradius
'';
};
users.users.nginx.extraGroups = lib.mkAfter [ "acme" ];

13
ops/nixos/clouvider-lon01/default.nix
View file

@ -193,14 +193,11 @@ in {
dataDir = "/persist/etc/znc";
useLegacyConfig = false;
};
security.acme = {
acceptTerms = true;
email = "letsencrypt@lukegb.com";
certs."znc.lukegb.com" = {
webroot = "/var/lib/acme/.challenges";
group = "znc-acme";
extraDomainNames = ["akiichiro.lukegb.com"];
};
security.acme.certs."znc.lukegb.com" = {
dnsProvider = null;
webroot = "/var/lib/acme/.challenges";
group = "znc-acme";
extraDomainNames = ["akiichiro.lukegb.com"];
};
services.nginx = {
enable = true;

28
ops/nixos/etheroute-lon01/default.nix
View file

@ -343,23 +343,17 @@ in {
wants = lib.mkAfter [ "redis.service" ];
after = lib.mkAfter [ "redis.service" ];
};
security.acme = {
acceptTerms = true;
email = "letsencrypt@lukegb.com";
certs."int.lukegb.com" = {
domain = "*.int.lukegb.com";
dnsProvider = "cloudflare";
credentialsFile = secrets.cloudflareCredentials;
extraDomainNames = [
# "int.lukegb.com" # redundant with *.lukegb.com
"lukegb.com"
"*.lukegb.com"
"objdump.zxcvbnm.ninja"
];
postRun = ''
systemctl restart pomerium
'';
};
security.acme.certs."int.lukegb.com" = {
domain = "*.int.lukegb.com";
extraDomainNames = [
# "int.lukegb.com" # redundant with *.lukegb.com
"lukegb.com"
"*.lukegb.com"
"objdump.zxcvbnm.ninja"
];
postRun = ''
systemctl restart pomerium
'';
};
system.stateVersion = "20.09";

12
ops/nixos/lib/as205479-web.nix
View file

@ -1,14 +1,10 @@
{ config, depot, lib, ... }:
{
security.acme = {
acceptTerms = true;
email = lib.mkDefault "letsencrypt@lukegb.com";
certs."as205479.net" = {
dnsProvider = "gcloud";
credentialsFile = depot.ops.secrets.gcpDNSCredentials;
dnsPropagationCheck = false;
};
security.acme.certs."as205479.net" = {
dnsProvider = "gcloud";
credentialsFile = depot.ops.secrets.gcpDNSCredentials;
dnsPropagationCheck = false;
};
services.nginx = {
enable = lib.mkDefault true;

10
ops/nixos/lib/common.nix
View file

@ -5,6 +5,7 @@
{ pkgs, config, depot, lib, rebuilder, ... }@args:
let
inherit (lib) mkDefault;
inherit (depot.ops) secrets;
switch-prebuilt = import ./switch-prebuilt.nix args;
in
@ -268,5 +269,14 @@ in
ListenStream = [ "" "${config.my.ip.tailscale}:19531" ];
FreeBind = true;
};
security.acme = {
acceptTerms = true;
defaults = {
email = "letsencrypt@lukegb.com";
dnsProvider = "cloudflare";
credentialsFile = secrets.cloudflareCredentials;
};
};
};
}

10
ops/nixos/lib/fup.nix
View file

@ -27,14 +27,8 @@ in
ssl = true;
}) config.my.fup.listen);
in {
security.acme = {
acceptTerms = true;
email = lib.mkDefault "letsencrypt@lukegb.com";
certs."p.lukegb.com" = {
group = config.services.nginx.group;
dnsProvider = "cloudflare";
credentialsFile = secrets.cloudflareCredentials;
};
security.acme.certs."p.lukegb.com" = {
group = config.services.nginx.group;
};
services.nginx = {
enable = lib.mkDefault true;

12
ops/nixos/lib/quotes.bfob.gg.nix
View file

@ -25,15 +25,9 @@ in
ssl = true;
}) config.my.quotesdb.listen);
in {
security.acme = {
acceptTerms = true;
email = lib.mkDefault "letsencrypt@lukegb.com";
certs."bfob.gg" = {
group = config.services.nginx.group;
dnsProvider = "cloudflare";
credentialsFile = secrets.cloudflareCredentials;
extraDomainNames = ["*.bfob.gg"];
};
security.acme.certs."bfob.gg" = {
group = config.services.nginx.group;
extraDomainNames = ["*.bfob.gg"];
};
services.nginx = {
enable = lib.mkDefault true;

5
ops/nixos/marukuru/default.nix
View file

@ -109,11 +109,6 @@ in {
selector = "marukuru";
};
security.acme = {
acceptTerms = true;
email = "letsencrypt@lukegb.com";
};
virtualisation.docker.extraOptions = "--experimental --ipv6 --ip6tables --fixed-cidr-v6 2402:28c0:4:104e:d000::/68";
# Container networking.

6
ops/nixos/totoro/default.nix
View file

@ -201,20 +201,14 @@ in {
};
security.acme = {
acceptTerms = true;
email = "letsencrypt@lukegb.com";
certs."invoices.lukegb.com" = {
domain = "invoices.lukegb.com";
dnsProvider = "cloudflare";
credentialsFile = secrets.cloudflareCredentials;
postRun = ''
systemctl reload nginx
'';
};
certs."trains.lukegb.com" = {
domain = "trains.lukegb.com";
dnsProvider = "cloudflare";
credentialsFile = secrets.cloudflareCredentials;
};
};