blob: b5694c9b86ae1af2a6bcf2f379095272b9f978b1 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
|
{ config, lib, pkgs, ... }:
with lib;
let
cfg = config.security.acme;
knotCfg = config.services.knot;
knotDNSCredentials = domain: let
zone = if cfg.domains.${domain}.zone == null then domain else cfg.domains.${domain}.zone;
in pkgs.writeText "lego-credentials" ''
EXEC_PATH=${knotDNSExec zone}/bin/update-dns.sh
EXEC_PROPAGATION_TIMEOUT=300
EXEC_POLLING_INTERVAL=5
'';
knotDNSExec = zone: pkgs.writeScriptBin "update-dns.sh" ''
#!${pkgs.zsh}/bin/zsh -xe
mode=$1
fqdn=$2
challenge=$3
owner=''${fqdn%".${zone}."}
commited=
function abort() {
[[ -n "''${commited}" ]] || ${knotCfg.cliWrappers}/bin/knotc zone-abort "${zone}"
}
${knotCfg.cliWrappers}/bin/knotc zone-begin "${zone}"
trap abort EXIT
case "''${mode}" in
present)
if ${knotCfg.cliWrappers}/bin/knotc zone-get ${zone} "''${owner}" TXT; then
${knotCfg.cliWrappers}/bin/knotc zone-unset ${zone} "''${owner}" TXT '""'
fi
${knotCfg.cliWrappers}/bin/knotc zone-set ${zone} "''${owner}" 30 TXT "''${challenge}"
;;
cleanup)
${knotCfg.cliWrappers}/bin/knotc zone-unset ${zone} "''${owner}" TXT "''${challenge}"
${knotCfg.cliWrappers}/bin/knotc zone-set ${zone} "''${owner}" 30 TXT '""'
;;
*)
exit 2
;;
esac
${knotCfg.cliWrappers}/bin/knotc zone-commit "${zone}"
commited=yes
'';
domainOptions = {
options = {
wildcard = mkOption {
type = types.bool;
default = false;
};
zone = mkOption {
type = types.nullOr types.str;
default = null;
};
certCfg = mkOption {
type = types.attrs;
default = {};
};
};
};
in {
options = {
security.acme = {
domains = mkOption {
type = types.attrsOf (types.submodule domainOptions);
default = {};
};
};
};
config = {
security.acme.domains = genAttrs ["dirty-haskell.org" "141.li" "xmpp.li" "yggdrasil.li" "praseodym.org" "rheperire.org" "kleen.li" "nights.email"] (domain: { wildcard = true; });
fileSystems."/var/lib/acme" =
{ device = "surtr/safe/var-lib-acme";
fsType = "zfs";
};
security.acme = {
acceptTerms = true;
preliminarySelfsigned = true; # DNS challenge is slow
defaults = {
email = "phikeebaogobaegh@141.li";
keyType = "rsa4096"; # we don't like NIST curves
extraLegoFlags = ["--preferred-chain" "ISRG Root X1"];
};
certs =
let
domainAttrset = domain: {
inherit domain;
extraDomainNames = optional cfg.domains.${domain}.wildcard "*.${domain}";
dnsProvider = "exec";
credentialsFile = knotDNSCredentials domain;
dnsResolver = "1.1.1.1:53";
} // cfg.domains.${domain}.certCfg;
in genAttrs (attrNames cfg.domains) domainAttrset;
};
systemd.services =
let
serviceAttrset = domain: {
after = [ "knot.service" ];
bindsTo = [ "knot.service" ];
serviceConfig = {
ReadWritePaths = ["/run/knot/knot.sock"];
SupplementaryGroups = ["knot"];
RestrictAddressFamilies = ["AF_UNIX"];
};
};
in mapAttrs' (domain: nameValuePair "acme-${domain}") (genAttrs (attrNames config.security.acme.certs) serviceAttrset);
};
}
|
