summaryrefslogtreecommitdiff
path: root/hosts/surtr/tls.nix
blob: 97a9649d40739e622ea636c2e0f56fa73f75b455 (plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
{ config, lib, pkgs, ... }:

with lib;

let
  cfg = config.security.acme;
  knotCfg = config.services.knot;
  
  knotDNSCredentials = zone: pkgs.writeText "lego-credentials" ''
    EXEC_PATH=${knotDNSExec zone}/bin/update-dns.sh
    EXEC_PROPAGATION_TIMEOUT=300
    EXEC_POLLING_INTERVAL=5
  '';
  knotDNSExec = domain:
    let
      zone = if cfg.domains.${domain}.zone == null then domain else cfg.domains.${domain}.zone;
    in pkgs.writeScriptBin "update-dns.sh" ''
      #!${pkgs.zsh}/bin/zsh -xe

      mode=$1
      fqdn=$2
      challenge=$3

      owner=''${fqdn%".${domain}."}

      commited=
      function abort() {
        [[ -n "''${commited}" ]] || ${knotCfg.cliWrappers}/bin/knotc zone-abort "${zone}"
      }

      ${knotCfg.cliWrappers}/bin/knotc zone-begin "${zone}"
      trap abort EXIT

      case "''${mode}" in
        present)
          ${knotCfg.cliWrappers}/bin/knotc zone-unset ${zone} "''${owner}" TXT '""'
          ${knotCfg.cliWrappers}/bin/knotc zone-set ${zone} "''${owner}" 30 TXT "''${challenge}"
          ;;
        cleanup)
          ${knotCfg.cliWrappers}/bin/knotc zone-unset ${zone} "''${owner}" TXT "''${challenge}"
          ${knotCfg.cliWrappers}/bin/knotc zone-set ${zone} "''${owner}" 30 TXT '""'
          ;;
        *)
          exit 2
          ;;
      esac

      ${knotCfg.cliWrappers}/bin/knotc zone-commit "${zone}"
      commited=yes
    '';
  
  domainOptions = {
    options = {
      wildcard = mkOption {
        type = types.bool;
        default = false;
      };
      zone = mkOption {
        type = types.nullOr types.str;
        default = null;
      };
    };
  };
in {
  options = {
    security.acme = {
      domains = mkOption {
        type = types.attrsOf (types.submodule domainOptions);
        default = {};
      };
    };
  };
  
  config = {
    security.acme.domains = genAttrs ["dirty-haskell.org" "141.li" "xmpp.li" "yggdrasil.li" "praseodym.org" "rheperire.org" "kleen.li" "nights.email"] (domain: { wildcard = true; });
    
    fileSystems."/var/lib/acme" =
      { device = "surtr/safe/var-lib-acme";
        fsType = "zfs";
      };

    security.acme = {
      acceptTerms = true;
      preliminarySelfsigned = true; # DNS challenge is slow
      defaults.email = "phikeebaogobaegh@141.li";
      certs =
        let
          domainAttrset = domain: {
            inherit domain;
            extraDomainNames = optional cfg.domains.${domain}.wildcard "*.${domain}";
            dnsProvider = "exec";
            credentialsFile = knotDNSCredentials domain;
            dnsResolver = "1.1.1.1:53";
            keyType = "rsa4096"; # we don't like NIST curves
          };
        in genAttrs (attrNames cfg.domains) domainAttrset;
    };

    systemd.services =
      let
        serviceAttrset = domain: {
          after = [ "knot.service" ];
          bindsTo = [ "knot.service" ];
          serviceConfig = {
            ReadWritePaths = ["/run/knot/knot.sock"];
            SupplementaryGroups = ["knot"];
            RestrictAddressFamilies = ["AF_UNIX"];
          };
        };
      in mapAttrs' (domain: nameValuePair "acme-${domain}") (genAttrs (attrNames config.security.acme.certs) serviceAttrset);
  };
}