diff options
Diffstat (limited to 'modules')
| -rw-r--r-- | modules/hosts/sachiel/flake-parts.nix | 2 | ||||
| -rw-r--r-- | modules/hosts/sachiel/secrets.nix | 11 | ||||
| -rw-r--r-- | modules/services/acme.nix | 25 | ||||
| -rw-r--r-- | modules/services/cgit.nix | 4 | ||||
| -rw-r--r-- | modules/services/nextcloud.nix | 3 | ||||
| -rw-r--r-- | modules/services/site.nix | 29 |
6 files changed, 32 insertions, 42 deletions
diff --git a/modules/hosts/sachiel/flake-parts.nix b/modules/hosts/sachiel/flake-parts.nix index a81f0d6..9b2c143 100644 --- a/modules/hosts/sachiel/flake-parts.nix +++ b/modules/hosts/sachiel/flake-parts.nix @@ -7,9 +7,9 @@ inputs.self.modules.nixos.sachiel inputs.self.modules.nixos.openssh inputs.self.modules.nixos.nginx + inputs.self.modules.nixos.acme inputs.self.modules.nixos.nextcloud inputs.self.modules.nixos.mail - inputs.self.modules.nixos.site inputs.self.modules.nixos.git inputs.self.modules.nixos.cgit ]; diff --git a/modules/hosts/sachiel/secrets.nix b/modules/hosts/sachiel/secrets.nix index c301477..364522f 100644 --- a/modules/hosts/sachiel/secrets.nix +++ b/modules/hosts/sachiel/secrets.nix @@ -34,13 +34,10 @@ mode = "0400"; path = "/var/lib/git-server/.ssh/authorized_keys"; }; - "cert_fullchain" = { - owner = "nginx"; - group = "nginx"; - }; - "cert_private" = { - owner = "nginx"; - group = "nginx"; + "ionos-acme-env" = { + owner = "acme"; + group = "acme"; + mode = "0400"; }; }; }; diff --git a/modules/services/acme.nix b/modules/services/acme.nix new file mode 100644 index 0000000..0b6c475 --- /dev/null +++ b/modules/services/acme.nix @@ -0,0 +1,25 @@ +{ + flake.modules.nixos.acme = + { config, ... }: + { + security.acme = { + acceptTerms = true; + defaults.server = "https://acme.ionos.com/directory"; + certs."schererleander.de" = { + extraDomainNames = [ + "cloud.schererleander.de" + "git.schererleander.de" + ]; + extraLegoFlags = [ "--eab" ]; + environmentFile = config.sops.secrets."ionos-acme-env".path; + group = "nginx"; + }; + }; + + services.nginx.virtualHosts."schererleander.de" = { + enableACME = true; + forceSSL = true; + locations."/".return = "301 https://github.com/schererleander"; + }; + }; +} diff --git a/modules/services/cgit.nix b/modules/services/cgit.nix index 9b1b3c4..a27fd02 100644 --- a/modules/services/cgit.nix +++ b/modules/services/cgit.nix @@ -1,7 +1,6 @@ { flake.modules.nixos.cgit = { - config, lib, pkgs, ... @@ -50,8 +49,7 @@ services.nginx.virtualHosts."git.schererleander.de" = { forceSSL = true; - sslCertificate = config.sops.secrets."cert_fullchain".path; - sslCertificateKey = config.sops.secrets."cert_private".path; + useACMEHost = "schererleander.de"; }; }; } diff --git a/modules/services/nextcloud.nix b/modules/services/nextcloud.nix index b8d2adc..65f0b15 100644 --- a/modules/services/nextcloud.nix +++ b/modules/services/nextcloud.nix @@ -65,8 +65,7 @@ services.nginx.virtualHosts = { "cloud.schererleander.de" = { forceSSL = true; - sslCertificate = config.sops.secrets."cert_fullchain".path; - sslCertificateKey = config.sops.secrets."cert_private".path; + useACMEHost = "schererleander.de"; }; }; diff --git a/modules/services/site.nix b/modules/services/site.nix deleted file mode 100644 index 93342f2..0000000 --- a/modules/services/site.nix +++ /dev/null @@ -1,29 +0,0 @@ -{ - flake.modules.nixos.site = - { - config, - inputs, - ... - }: - { - /* - imports = [ - inputs.site.nixosModules.default - ]; - - services.site = { - enable = true; - domain = "schererleander.de"; - sslCertificate = config.sops.secrets."cert_fullchain".path; - sslCertificateKey = config.sops.secrets."cert_private".path; - }; - */ - - services.nginx.virtualHosts."schererleander.de" = { - forceSSL = true; - sslCertificate = config.sops.secrets."cert_fullchain".path; - sslCertificateKey = config.sops.secrets."cert_private".path; - locations."/".return = "301 https://github.com/schererleander"; - }; - }; -} |