4 files changed, 14 insertions, 20 deletions
diff --git a/modules/hosts/sachiel/secrets.nix b/modules/hosts/sachiel/secrets.nix
index 364522f..c301477 100644
--- a/modules/hosts/sachiel/secrets.nix
+++ b/modules/hosts/sachiel/secrets.nix
@@ -34,10 +34,13 @@
             mode = "0400";
             path = "/var/lib/git-server/.ssh/authorized_keys";
           };
-          "ionos-acme-env" = {
-            owner = "acme";
-            group = "acme";
-            mode = "0400";
+          "cert_fullchain" = {
+            owner = "nginx";
+            group = "nginx";
+          };
+          "cert_private" = {
+            owner = "nginx";
+            group = "nginx";
           };
         };
       };
diff --git a/modules/services/acme.nix b/modules/services/acme.nix
index 128715c..5ece2cf 100644
--- a/modules/services/acme.nix
+++ b/modules/services/acme.nix
@@ -2,22 +2,10 @@
   flake.modules.nixos.acme =
     { config, ... }:
     {
-      security.acme = {
-        acceptTerms = true;
-        defaults = {
-          server = "https://acme.ionos.com/directory";
-          extraLegoFlags = [ "--eab" ];
-          environmentFile = config.sops.secrets."ionos-acme-env".path;
-          group = "nginx";
-        };
-        certs."schererleander.de" = {
-          domain = "*.schererleander.de";
-        };
-      };
-
       services.nginx.virtualHosts."schererleander.de" = {
-        enableACME = true;
         forceSSL = true;
+        sslCertificate = config.sops.secrets."cert_fullchain".path;
+        sslCertificateKey = config.sops.secrets."cert_private".path;
         locations."/".return = "301 https://github.com/schererleander";
       };
     };
diff --git a/modules/services/cgit.nix b/modules/services/cgit.nix
index a27fd02..9b1b3c4 100644
--- a/modules/services/cgit.nix
+++ b/modules/services/cgit.nix
@@ -1,6 +1,7 @@
 {
   flake.modules.nixos.cgit =
     {
+      config,
       lib,
       pkgs,
       ...
@@ -49,7 +50,8 @@
 
       services.nginx.virtualHosts."git.schererleander.de" = {
         forceSSL = true;
-        useACMEHost = "schererleander.de";
+        sslCertificate = config.sops.secrets."cert_fullchain".path;
+        sslCertificateKey = config.sops.secrets."cert_private".path;
       };
     };
 }
diff --git a/modules/services/nextcloud.nix b/modules/services/nextcloud.nix
index 65f0b15..b8d2adc 100644
--- a/modules/services/nextcloud.nix
+++ b/modules/services/nextcloud.nix
@@ -65,7 +65,8 @@
       services.nginx.virtualHosts = {
         "cloud.schererleander.de" = {
           forceSSL = true;
-          useACMEHost = "schererleander.de";
+          sslCertificate = config.sops.secrets."cert_fullchain".path;
+          sslCertificateKey = config.sops.secrets."cert_private".path;
         };
       };