switched ssl certs to security.acme completely

2 files changed, 9 insertions, 38 deletions

diff --git a/custom/simp_le.nix b/custom/simp_le.nix
deleted file mode 100644
index d37fbb8c..00000000
--- a/custom/simp_le.nix
+++ /dev/null
@@ -1,32 +0,0 @@
-{ stdenv, writeText
-, simp_le
-, eject
-}:
-#dir:
-domain:
-
-let
-  dir = "/etc/ssl/self/${domain}";
-  script = writeText "${domain}.sh" ''
-    backupDir=/root/ssl_archive/$(date +'%Y-%m-%d')-$$-${domain}
-    mkdir -p ${dir}
-    cd ${dir}
-    mkdir -p $backupDir
-    for f in account_key.json cert.pem fullchain.pem key.pem privkey.pem; do
-      [[ -e $f ]] && mv -v $f $backupDir
-    done
-    ${simp_le}/bin/simp_le -d ${domain}:/srv/www/acme/${domain}/ \
-      --email "phikeebaogobaegh@141.li" \
-      -f account_key.json \
-      -f cert.pem \
-      -f fullchain.pem \
-      -f key.pem
-    if [[ $? -ne 0 ]]; then
-      for f in ./*; do rm -v $f; done
-      mv -v $backupDir/* . && rmdir $backupDir
-    else
-      [[ -e key.pem ]] && ln -s -f key.pem privkey.pem
-    fi
-  '';
-in
-  "bash ${script} 2>&1 | ${eject}/bin/logger -p auth.info"
diff --git a/custom/ymir-nginx.nix b/custom/ymir-nginx.nix
index 54b0084f..0506b5c7 100644
--- a/custom/ymir-nginx.nix
+++ b/custom/ymir-nginx.nix
@@ -28,6 +28,11 @@ let
       root /srv/www/acme/$host/;
     }
   '';
+
+  ssl = builtins.toFile "ssl" ''
+    ssl_certificate /var/lib/acme/yggdrasil.li/fullchain.pem;
+    ssl_certificate_key /var/lib/acme/yggdrasil.li/key.pem;
+  '';
 in {
   services.nginx = {
     enable = true;
@@ -104,8 +109,7 @@ in {
         include ${favicon};
         include ${acme};
 
-        ssl_certificate /etc/ssl/self/dirty-haskell.org/fullchain.pem;
-        ssl_certificate_key /etc/ssl/self/dirty-haskell.org/privkey.pem;
+        include ${ssl};
 
         root /srv/www/dirty-haskell.org;
       }
@@ -118,8 +122,7 @@ in {
         include ${favicon};
         include ${acme};
 
-        ssl_certificate /etc/ssl/self/www.dirty-haskell.org/fullchain.pem;
-        ssl_certificate_key /etc/ssl/self/www.dirty-haskell.org/privkey.pem;
+        include ${ssl};
 
         root /srv/www/dirty-haskell.org;
       }
@@ -129,8 +132,6 @@ in {
         listen *:443 ssl;
         listen [::]:80;
         listen [::]:443 ssl;
-        ssl_certificate /etc/ssl/self/git.yggdrasil.li/fullchain.pem;
-        ssl_certificate_key /etc/ssl/self/git.yggdrasil.li/key.pem;
         server_name git.yggdrasil.li;
 
         root ${pkgs.cgit}/cgit;
@@ -140,6 +141,8 @@ in {
         include ${favicon};
         include ${acme};
 
+        include ${ssl};
+
         location @cgit {
           include ${uwsgi_params};
           uwsgi_pass unix:/tmp/cgit.sock;