1 files changed, 23 insertions, 4 deletions

diff --git a/hosts/surtr/tls.nix b/hosts/surtr/tls.nix
index 6a1d6f84..704941e2 100644
--- a/hosts/surtr/tls.nix
+++ b/hosts/surtr/tls.nix
@@ -3,6 +3,7 @@
 with lib;
 
 let
+  cfg = config.security.acme;
   knotCfg = config.services.knot;
   
   knotDNSCredentials = zone: pkgs.writeText "lego-credentials" ''
@@ -45,9 +46,27 @@ let
     commited=yes
   '';
   
-  domains = ["dirty-haskell.org" "141.li" "xmpp.li" "yggdrasil.li" "praseodym.org" "rheperire.org" "kleen.li" "nights.email"];
+  domainOptions = {
+    options = {
+      wildcard = mkOption {
+        type = types.bool;
+        default = false;
+      };
+    };
+  };
 in {
+  options = {
+    security.acme = {
+      domains = mkOption {
+        type = types.attrsOf (types.submodule domainOptions);
+        default = {};
+      };
+    };
+  };
+  
   config = {
+    security.acme.domains = genAttrs ["dirty-haskell.org" "141.li" "xmpp.li" "yggdrasil.li" "praseodym.org" "rheperire.org" "kleen.li" "nights.email"] (domain: { wildcard = true; });
+    
     fileSystems."/var/lib/acme" =
       { device = "surtr/safe/var-lib-acme";
         fsType = "zfs";
@@ -61,13 +80,13 @@ in {
         let
           domainAttrset = domain: {
             inherit domain;
-            extraDomainNames = [ "*.${domain}" ];
+            extraDomainNames = optional cfg.domains.${domain}.wildcard "*.${domain}";
             dnsProvider = "exec";
             credentialsFile = knotDNSCredentials domain;
             dnsResolver = "1.1.1.1:53";
             keyType = "rsa4096"; # we don't like NIST curves
           };
-        in genAttrs domains domainAttrset;
+        in genAttrs (attrNames cfg.domains) domainAttrset;
     };
 
     systemd.services =
@@ -81,6 +100,6 @@ in {
             RestrictAddressFamilies = ["AF_UNIX"];
           };
         };
-      in mapAttrs' (domain: nameValuePair "acme-${domain}") (genAttrs domains serviceAttrset);
+      in mapAttrs' (domain: nameValuePair "acme-${domain}") (genAttrs (attrNames config.security.acme.certs) serviceAttrset);
   };
 }