1 files changed, 13 insertions, 3 deletions

diff --git a/hosts/surtr/dns/default.nix b/hosts/surtr/dns/default.nix
index 57146d67..dc991b66 100644
--- a/hosts/surtr/dns/default.nix
+++ b/hosts/surtr/dns/default.nix
@@ -23,7 +23,9 @@ let
 
   indentString = indentation: str: concatMapStringsSep "\n" (str: "  ${str}") (splitString "\n" (removeSuffix "\n" str));
 
-  mkZone = {domain, path ? (./zones + "/${reverseDomain domain}.soa"), acmeDomains ? [domain]}: indentString "  " ''
+  mkZone = {domain, path ? (./zones + "/${reverseDomain domain}.soa"), acmeDomains ? [domain], addACLs ? {}}: indentString "  " (let
+    keys = acmeDomain: [(assert (config.sops.secrets ? "${acmeDomain}_acme.yaml"); "${acmeDomain}_acme_acl")] ++ (addACLs.${acmeDomain} or []);
+  in ''
     - domain: ${domain}
       template: inwx_zone
       ${optionalString (acmeDomains != []) "acl: [local_acl, inwx_acl]"}
@@ -31,10 +33,10 @@ let
     ${concatMapStringsSep "\n" (acmeDomain: ''
       - domain: _acme-challenge.${acmeDomain}
         template: acme_zone
-        acl: [${assert (config.sops.secrets ? "${acmeDomain}_acme.yaml"); "${acmeDomain}_acme_acl"}]
+        acl: [${concatStringsSep ", " (keys acmeDomain)}]
         file: ${acmeChallengeZonefile acmeDomain}
     '') acmeDomains}
-  '';
+  '');
 in {
   config = {
     fileSystems."/var/lib/knot" =
@@ -152,21 +154,29 @@ in {
         zone:
         ${concatMapStringsSep "\n" mkZone [
           { domain = "yggdrasil.li";
+            addACLs = { "yggdrasil.li" = ["ymir_acme_acl"]; };
           }
           { domain = "nights.email";
+            addACLs = { "nights.email" = ["ymir_acme_acl"]; };
           }
           { domain = "141.li";
             acmeDomains = ["webdav.141.li" "141.li"];
+            addACLs = { "141.li" = ["ymir_acme_acl"]; };
           }
           { domain = "kleen.li";
+            addACLs = { "kleen.li" = ["ymir_acme_acl"]; };
           }
           { domain = "xmpp.li";
+            addACLs = { "xmpp.li" = ["ymir_acme_acl"]; };
           }
           { domain = "dirty-haskell.org";
+            addACLs = { "dirty-haskell.org" = ["ymir_acme_acl"]; };
           }
           { domain = "praseodym.org";
+            addACLs = { "praseodym.org" = ["ymir_acme_acl"]; };
           }
           { domain = "rheperire.org";
+            addACLs = { "rheperire.org" = ["ymir_acme_acl"]; };
           }
         ]}
       '';