ops/nixos: tidy up security.acme

ops/nixos/blade-tuvok/default.nix

@@ -77,18 +77,12 @@ in {
       };
     };
   };
-  security.acme = {
-    acceptTerms = true;
-    email = "letsencrypt@lukegb.com";
-    certs."objdump.zxcvbnm.ninja" = {
+  security.acme.certs."objdump.zxcvbnm.ninja" = {
     group = config.services.nginx.group;
-      dnsProvider = "cloudflare";
-      credentialsFile = secrets.cloudflareCredentials;
     extraDomainNames = [
       "*.objdump.zxcvbnm.ninja"
     ];
   };
-  };
   my.fup.listen = [
     "0.0.0.0" "[::]"
   ];

ops/nixos/bvm-matrix/default.nix

@@ -168,16 +168,10 @@ in {
     members = [ "turnserver" "nginx" ];
   };
 
-  security.acme = {
-    acceptTerms = true;
-    email = "letsencrypt@lukegb.com";
-    certs."matrix.zxcvbnm.ninja" = {
+  security.acme.certs."matrix.zxcvbnm.ninja" = {
     group = "matrixcert";
-      dnsProvider = "cloudflare";
-      credentialsFile = secrets.cloudflareCredentials;
     extraDomainNames = [ "element.zxcvbnm.ninja" "zxcvbnm.ninja" ];
   };
-  };
 
   system.stateVersion = "21.05";
 }

ops/nixos/bvm-prosody/default.nix

@@ -87,18 +87,12 @@ in {
   };
 
   security.acme = {
-    acceptTerms = true;
-    email = "letsencrypt@lukegb.com";
     certs."xmpp.lukegb.com" = {
       group = "prosody";
-      dnsProvider = "cloudflare";
-      credentialsFile = secrets.cloudflareCredentials;
       extraDomainNames = [ "*.xmpp.lukegb.com" "lukegb.com" ];
     };
     certs."turn.lukegb.com" = {
       group = "turnserver";
-      dnsProvider = "cloudflare";
-      credentialsFile = secrets.cloudflareCredentials;
     };
   };
 

ops/nixos/bvm-radius/default.nix

@@ -51,10 +51,7 @@ in {
   };
   my.ip.tailscale = "100.120.98.116";
 
-  security.acme = {
-    acceptTerms = true;
-    email = "letsencrypt@lukegb.com";
-    certs."as205479.net" = {
+  security.acme.certs."as205479.net" = {
     extraDomainNames = [ "www.as205479.net" ];
     dnsProvider = "gcloud";
     credentialsFile = secrets.gcpDNSCredentials;
@@ -63,7 +60,6 @@ in {
       systemctl restart freeradius
     '';
   };
-  };
   users.users.nginx.extraGroups = lib.mkAfter [ "acme" ];
 
   system.stateVersion = "21.05";

ops/nixos/clouvider-lon01/default.nix

@@ -193,15 +193,12 @@ in {
     dataDir = "/persist/etc/znc";
     useLegacyConfig = false;
   };
-  security.acme = {
-    acceptTerms = true;
-    email = "letsencrypt@lukegb.com";
-    certs."znc.lukegb.com" = {
+  security.acme.certs."znc.lukegb.com" = {
+    dnsProvider = null;
     webroot = "/var/lib/acme/.challenges";
     group = "znc-acme";
     extraDomainNames = ["akiichiro.lukegb.com"];
   };
-  };
   services.nginx = {
     enable = true;
     virtualHosts = {

ops/nixos/etheroute-lon01/default.nix

@@ -343,13 +343,8 @@ in {
     wants = lib.mkAfter [ "redis.service" ];
     after = lib.mkAfter [ "redis.service" ];
   };
-  security.acme = {
-    acceptTerms = true;
-    email = "letsencrypt@lukegb.com";
-    certs."int.lukegb.com" = {
+  security.acme.certs."int.lukegb.com" = {
     domain = "*.int.lukegb.com";
-      dnsProvider = "cloudflare";
-      credentialsFile = secrets.cloudflareCredentials;
     extraDomainNames = [
       # "int.lukegb.com"  # redundant with *.lukegb.com
       "lukegb.com"
@@ -360,7 +355,6 @@ in {
       systemctl restart pomerium
     '';
   };
-  };
 
   system.stateVersion = "20.09";
 }

ops/nixos/lib/as205479-web.nix

@@ -1,15 +1,11 @@
 { config, depot, lib, ... }:
 
 {
-  security.acme = {
-    acceptTerms = true;
-    email = lib.mkDefault "letsencrypt@lukegb.com";
-    certs."as205479.net" = {
+  security.acme.certs."as205479.net" = {
     dnsProvider = "gcloud";
     credentialsFile = depot.ops.secrets.gcpDNSCredentials;
     dnsPropagationCheck = false;
   };
-  };
   services.nginx = {
     enable = lib.mkDefault true;
     virtualHosts."as205479.net" = {

ops/nixos/lib/common.nix

@@ -5,6 +5,7 @@
 { pkgs, config, depot, lib, rebuilder, ... }@args:
 let 
   inherit (lib) mkDefault;
+  inherit (depot.ops) secrets;
 
   switch-prebuilt = import ./switch-prebuilt.nix args;
 in
@@ -268,5 +269,14 @@ in
       ListenStream = [ "" "${config.my.ip.tailscale}:19531" ];
       FreeBind = true;
     };
+
+    security.acme = {
+      acceptTerms = true;
+      defaults = {
+        email = "letsencrypt@lukegb.com";
+        dnsProvider = "cloudflare";
+        credentialsFile = secrets.cloudflareCredentials;
+      };
+    };
   };
 }

ops/nixos/lib/fup.nix

@@ -27,14 +27,8 @@ in
       ssl = true;
     }) config.my.fup.listen);
   in {
-    security.acme = {
-      acceptTerms = true;
-      email = lib.mkDefault "letsencrypt@lukegb.com";
-      certs."p.lukegb.com" = {
+    security.acme.certs."p.lukegb.com" = {
       group = config.services.nginx.group;
-        dnsProvider = "cloudflare";
-        credentialsFile = secrets.cloudflareCredentials;
-      };
     };
     services.nginx = {
       enable = lib.mkDefault true;

ops/nixos/lib/quotes.bfob.gg.nix

@@ -25,16 +25,10 @@ in
       ssl = true;
     }) config.my.quotesdb.listen);
   in {
-    security.acme = {
-      acceptTerms = true;
-      email = lib.mkDefault "letsencrypt@lukegb.com";
-      certs."bfob.gg" = {
+    security.acme.certs."bfob.gg" = {
       group = config.services.nginx.group;
-        dnsProvider = "cloudflare";
-        credentialsFile = secrets.cloudflareCredentials;
       extraDomainNames = ["*.bfob.gg"];
     };
-    };
     services.nginx = {
       enable = lib.mkDefault true;
       virtualHosts."qdb.bfob.gg" = {

ops/nixos/marukuru/default.nix

@@ -109,11 +109,6 @@ in {
     selector = "marukuru";
   };
 
-  security.acme = {
-    acceptTerms = true;
-    email = "letsencrypt@lukegb.com";
-  };
-
   virtualisation.docker.extraOptions = "--experimental --ipv6 --ip6tables --fixed-cidr-v6 2402:28c0:4:104e:d000::/68";
 
   # Container networking.

ops/nixos/totoro/default.nix

@@ -201,20 +201,14 @@ in {
   };
 
   security.acme = {
-    acceptTerms = true;
-    email = "letsencrypt@lukegb.com";
     certs."invoices.lukegb.com" = {
       domain = "invoices.lukegb.com";
-      dnsProvider = "cloudflare";
-      credentialsFile = secrets.cloudflareCredentials;
       postRun = ''
         systemctl reload nginx
       '';
     };
     certs."trains.lukegb.com" = {
       domain = "trains.lukegb.com";
-      dnsProvider = "cloudflare";
-      credentialsFile = secrets.cloudflareCredentials;
     };
   };