jan-leila/nix-config
1
0
Fork 1
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

added acme to impermanence

Browse source
This commit is contained in:
Leyla Becker 2025-01-03 13:07:52 -06:00
parent b02bd1a5e2
commit 6ab64fafe1
2 changed files with 44 additions and 26 deletions
Download patch file Download diff file Expand all files Collapse all files

5
configurations/nixos/defiant/services.nix
View file

@ -135,11 +135,6 @@ in {
}; };
}; };
security.acme = {
acceptTerms = true;
defaults.email = "jan-leila@protonmail.com";
};
networking.firewall.allowedTCPPorts = networking.firewall.allowedTCPPorts =
[ [
httpPort httpPort

65
modules/nixos-modules/server/reverse_proxy.nix
View file

@ -2,7 +2,9 @@
lib, lib,
config, config,
... ...
}: { }: let
dataDir = "/var/lib/acme";
in {
options.host.reverse_proxy = { options.host.reverse_proxy = {
enable = lib.mkEnableOption "turn on the reverse proxy"; enable = lib.mkEnableOption "turn on the reverse proxy";
hostname = lib.mkOption { hostname = lib.mkOption {
@ -32,25 +34,46 @@
}; };
}; };
# TODO: impermanence for ACME keys config = lib.mkIf config.host.reverse_proxy.enable (lib.mkMerge [
config = { {
security.acme = lib.mkIf config.host.reverse_proxy.enableACME { security.acme = lib.mkIf config.host.reverse_proxy.enableACME {
acceptTerms = true; acceptTerms = true;
defaults.email = "jan-leila@protonmail.com"; defaults.email = "jan-leila@protonmail.com";
}; };
services.nginx = { services.nginx = {
enable = config.host.reverse_proxy.enable; enable = true;
virtualHosts = lib.attrsets.mapAttrs' (name: value: virtualHosts = lib.attrsets.mapAttrs' (name: value:
lib.attrsets.nameValuePair "${name}.${config.host.reverse_proxy.hostname}" { lib.attrsets.nameValuePair "${name}.${config.host.reverse_proxy.hostname}" {
forceSSL = config.host.reverse_proxy.forceSSL; forceSSL = config.host.reverse_proxy.forceSSL;
enableACME = config.host.reverse_proxy.enableACME; enableACME = config.host.reverse_proxy.enableACME;
locations."/" = { locations."/" = {
proxyPass = value.target; proxyPass = value.target;
proxyWebsockets = value.websockets; proxyWebsockets = value.websockets;
}; };
}) })
config.host.reverse_proxy.subdomains; config.host.reverse_proxy.subdomains;
}; };
}; }
(lib.mkIf config.host.impermanence.enable {
# TODO: figure out how to write an assertion for this
# assertions = [
# {
# assertion = security.acme.certs.<name>.directory == dataDir;
# message = "postgres data directory does not match persistence";
# }
# ];
environment.persistence."/persist/system/root" = {
enable = true;
hideMounts = true;
directories = [
{
directory = dataDir;
user = "acme";
group = "acme";
}
];
};
})
]);
} }