nixos/applications/acme.nix

43 lines
934 B
Nix

{ config, pkgs, lib, ... }:
with lib;
let
cfg = config.skynet_acme;
in {
imports = [];
options.skynet_acme = {
domains = lib.mkOption {
default = [ ];
type = lib.types.listOf lib.types.str;
description = ''
A list of domains to use for this server.
'';
};
};
config = {
# group that will own the certificates
users.groups.acme = {};
age.secrets.acme.file = ../secrets/dns_certs.secret.age;
security.acme = {
preliminarySelfsigned = false;
acceptTerms = true;
defaults = {
email = "admin_acme@skynet.ie";
# we use our own dns authorative server for verifying we own the domain.
dnsProvider = "rfc2136";
credentialsFile = config.age.secrets.acme.path;
};
certs = {
"skynet" = {
domain = "skynet.ie";
extraDomainNames = cfg.domains;
};
};
};
};
}