···

       
52
       
 
       


     

       
53
       
 
       
  # Attrset with the ACME certificate names split by whether or not they depend

     

       
54
       
 
       
  # on H2O serving challenges.

     

       
55
       
-
       
  certNames =

     

       
56
       
 
       
    let

     

       
57
       
 
       
      partition =

     

       
58
       
 
       
        acc: vhostSettings:

     
···

       
67
       
 
       
        else

     

       
68
       
 
       
          acc;

     

       
69
       
 
       


     

       
70
       
-
       
      certNames' = lib.lists.foldl partition {

     

       
71
       
 
       
        dependent = [ ];

     

       
72
       
 
       
        independent = [ ];

     

       
73
       
 
       
      } acmeEnabledHostsConfigs;

     

       
74
       
 
       
    in

     

       
75
       
-
       
    certNames'

     

       
76
       
 
       
    // {

     

       
77
       
-
       
      all = certNames'.dependent ++ certNames'.independent;

     

       
78
       
 
       
    };

     

       
79
       
 
       


     

       
80
       
 
       
  mozTLSRecs =

     
···

       
115
       
 
       


     

       
116
       
 
       
      names = getNames name value;

     

       
117
       
 
       


     

       
118
       
-
       
      acmeSettings = lib.optionalAttrs (builtins.elem names.cert certNames.dependent) (

     

       
119
       
 
       
        let

     

       
120
       
 
       
          acmePort = 80;

     

       
121
       
 
       
          acmeChallengePath = "/.well-known/acme-challenge";

     
···

       
165
       
 
       


     

       
166
       
 
       
                hasTLSRecommendations = tlsRecommendations != null && mozTLSRecs != null;

     

       
167
       
 
       


     

       
168
       
-
       
                # NOTE: Let’s Encrypt has sunset OCSP stapling. Mozilla’s

     

       
169
       
-
       
                # ssl-config-generator is at present still recommending this setting, but

     

       
170
       
-
       
                # this module will skip setting a stapling value as Let’s Encrypt +

     

       
171
       
-
       
                # ACME is the most likely use case.

     

       
172
       
-
       
                #

     

       
173
       
-
       
                # See: https://github.com/mozilla/ssl-config-generator/issues/323

     

       
174
       
-
       
                tlsRecAttrs = lib.optionalAttrs hasTLSRecommendations (

     

       
175
       
-
       
                  let

     

       
176
       
-
       
                    recs = mozTLSRecs.${tlsRecommendations};

     

       
177
       
-
       
                  in

     

       
178
       
-
       
                  {

     

       
179
       
-
       
                    min-version = builtins.head recs.tls_versions;

     

       
180
       
-
       
                    cipher-preference = "server";

     

       
181
       
-
       
                    "cipher-suite-tls1.3" = recs.ciphersuites;

     

       
182
       
 
       
                  }

     

       
183
       
-
       
                  // lib.optionalAttrs (recs.ciphers.openssl != [ ]) {

     

       
184
       
-
       
                    cipher-suite = lib.concatStringsSep ":" recs.ciphers.openssl;

     

       
185
       
-
       
                  }

     

       
186
       
-
       
                );

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
187
       
 
       


     

       
188
       
 
       
                headerRecAttrs =

     

       
189
       
 
       
                  lib.optionalAttrs

     
···

       
220
       
 
       
                  let

     

       
221
       
 
       
                    identity =

     

       
222
       
 
       
                      value.tls.identity

     

       
223
       
-
       
                      ++ lib.optional (builtins.elem names.cert certNames.all) {

     

       
224
       
 
       
                        key-file = "${certs.${names.cert}.directory}/key.pem";

     

       
225
       
 
       
                        certificate-file = "${certs.${names.cert}.directory}/fullchain.pem";

     

       
226
       
 
       
                      };

     
···

       
402
       
 
       
          groups = config.users.groups;

     

       
403
       
 
       
          services = [

     

       
404
       
 
       
            config.systemd.services.h2o

     

       
405
       
-
       
          ] ++ lib.optional (certNames.all != [ ]) config.systemd.services.h2o-config-reload;

     

       
406
       
 
       
        }

     

       
407
       
-
       
      ) certNames.all;

     

       
408
       
 
       


     

       
409
       
 
       
    users = {

     

       
410
       
 
       
      users.${cfg.user} =

     
···

       
420
       
 
       
    systemd.services.h2o = {

     

       
421
       
 
       
      description = "H2O HTTP server";

     

       
422
       
 
       
      wantedBy = [ "multi-user.target" ];

     

       
423
       
-
       
      wants = lib.concatLists (map (certName: [ "acme-finished-${certName}.target" ]) certNames.all);

     

       
424
       
 
       
      # Since H2O will be hosting the challenges, H2O must be started

     

       
425
       
-
       
      before = builtins.map (certName: "acme-${certName}.service") certNames.dependent;

     

       
426
       
 
       
      after =

     

       
427
       
 
       
        [ "network.target" ]

     

       
428
       
-
       
        ++ builtins.map (certName: "acme-selfsigned-${certName}.service") certNames.all

     

       
429
       
-
       
        ++ builtins.map (certName: "acme-${certName}.service") certNames.independent; # avoid loading self-signed key w/ real cert, or vice-versa

     

       
430
       
 
       


     

       
431
       
 
       
      serviceConfig = {

     

       
432
       
 
       
        ExecStart = "${h2oExe} --mode 'master'";

     
···

       
479
       
 
       
    # of certs end-to-end.

     

       
480
       
 
       
    systemd.services.h2o-config-reload =

     

       
481
       
 
       
      let

     

       
482
       
-
       
        tlsTargets = map (certName: "acme-${certName}.target") certNames.all;

     

       
483
       
-
       
        tlsServices = map (certName: "acme-${certName}.service") certNames.all;

     

       
484
       
 
       
      in

     

       
485
       
-
       
      mkIf (certNames.all != [ ]) {

     

       
486
       
 
       
        wantedBy = tlsServices ++ [ "multi-user.target" ];

     

       
487
       
 
       
        before = tlsTargets;

     

       
488
       
 
       
        after = tlsServices;

     

       
489
       
 
       
        unitConfig = {

     

       
490
       
-
       
          ConditionPathExists = map (certName: "${certs.${certName}.directory}/fullchain.pem") certNames.all;

     

       
0
       
 
       

     

       
0
       
 
       

     

       
491
       
 
       
          # Disable rate limiting for this since it may be triggered quickly

     

       
492
       
 
       
          # a bunch of times if a lot of certificates are renewed in quick

     

       
493
       
 
       
          # succession. The reload itself is cheap, so even doing a lot of them

     

···

       
52
       
 
       


     

       
53
       
 
       
  # Attrset with the ACME certificate names split by whether or not they depend

     

       
54
       
 
       
  # on H2O serving challenges.

     

       
55
       
+
       
  acmeCertNames =

     

       
56
       
 
       
    let

     

       
57
       
 
       
      partition =

     

       
58
       
 
       
        acc: vhostSettings:

     
···

       
67
       
 
       
        else

     

       
68
       
 
       
          acc;

     

       
69
       
 
       


     

       
70
       
+
       
      certNames = lib.lists.foldl partition {

     

       
71
       
 
       
        dependent = [ ];

     

       
72
       
 
       
        independent = [ ];

     

       
73
       
 
       
      } acmeEnabledHostsConfigs;

     

       
74
       
 
       
    in

     

       
75
       
+
       
    certNames

     

       
76
       
 
       
    // {

     

       
77
       
+
       
      all = certNames.dependent ++ certNames.independent;

     

       
78
       
 
       
    };

     

       
79
       
 
       


     

       
80
       
 
       
  mozTLSRecs =

     
···

       
115
       
 
       


     

       
116
       
 
       
      names = getNames name value;

     

       
117
       
 
       


     

       
118
       
+
       
      acmeSettings = lib.optionalAttrs (builtins.elem names.cert acmeCertNames.dependent) (

     

       
119
       
 
       
        let

     

       
120
       
 
       
          acmePort = 80;

     

       
121
       
 
       
          acmeChallengePath = "/.well-known/acme-challenge";

     
···

       
165
       
 
       


     

       
166
       
 
       
                hasTLSRecommendations = tlsRecommendations != null && mozTLSRecs != null;

     

       
167
       
 
       


     

       
168
       
+
       
                # ATTENTION: Let’s Encrypt has sunset OCSP stapling.

     

       
169
       
+
       
                tlsRecAttrs =

     

       
170
       
+
       
                  # If using ACME, this module will disable H2O’s default OCSP

     

       
171
       
+
       
                  # stapling.

     

       
172
       
+
       
                  #

     

       
173
       
+
       
                  # See: https://letsencrypt.org/2024/12/05/ending-ocsp/

     

       
174
       
+
       
                  lib.optionalAttrs (builtins.elem names.cert acmeCertNames.all) {

     

       
175
       
+
       
                    ocsp-update-interval = 0;

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
176
       
 
       
                  }

     

       
177
       
+
       
                  # Mozilla’s ssl-config-generator is at present still

     

       
178
       
+
       
                  # recommending this setting as well, but this module will

     

       
179
       
+
       
                  # skip setting a stapling value as Let’s Encrypt + ACME is

     

       
180
       
+
       
                  # the most likely use case.

     

       
181
       
+
       
                  #

     

       
182
       
+
       
                  # See: https://github.com/mozilla/ssl-config-generator/issues/323

     

       
183
       
+
       
                  // lib.optionalAttrs hasTLSRecommendations (

     

       
184
       
+
       
                    let

     

       
185
       
+
       
                      recs = mozTLSRecs.${tlsRecommendations};

     

       
186
       
+
       
                    in

     

       
187
       
+
       
                    {

     

       
188
       
+
       
                      min-version = builtins.head recs.tls_versions;

     

       
189
       
+
       
                      cipher-preference = "server";

     

       
190
       
+
       
                      "cipher-suite-tls1.3" = recs.ciphersuites;

     

       
191
       
+
       
                    }

     

       
192
       
+
       
                    // lib.optionalAttrs (recs.ciphers.openssl != [ ]) {

     

       
193
       
+
       
                      cipher-suite = lib.concatStringsSep ":" recs.ciphers.openssl;

     

       
194
       
+
       
                    }

     

       
195
       
+
       
                  );

     

       
196
       
 
       


     

       
197
       
 
       
                headerRecAttrs =

     

       
198
       
 
       
                  lib.optionalAttrs

     
···

       
229
       
 
       
                  let

     

       
230
       
 
       
                    identity =

     

       
231
       
 
       
                      value.tls.identity

     

       
232
       
+
       
                      ++ lib.optional (builtins.elem names.cert acmeCertNames.all) {

     

       
233
       
 
       
                        key-file = "${certs.${names.cert}.directory}/key.pem";

     

       
234
       
 
       
                        certificate-file = "${certs.${names.cert}.directory}/fullchain.pem";

     

       
235
       
 
       
                      };

     
···

       
411
       
 
       
          groups = config.users.groups;

     

       
412
       
 
       
          services = [

     

       
413
       
 
       
            config.systemd.services.h2o

     

       
414
       
+
       
          ] ++ lib.optional (acmeCertNames.all != [ ]) config.systemd.services.h2o-config-reload;

     

       
415
       
 
       
        }

     

       
416
       
+
       
      ) acmeCertNames.all;

     

       
417
       
 
       


     

       
418
       
 
       
    users = {

     

       
419
       
 
       
      users.${cfg.user} =

     
···

       
429
       
 
       
    systemd.services.h2o = {

     

       
430
       
 
       
      description = "H2O HTTP server";

     

       
431
       
 
       
      wantedBy = [ "multi-user.target" ];

     

       
432
       
+
       
      wants = lib.concatLists (map (certName: [ "acme-finished-${certName}.target" ]) acmeCertNames.all);

     

       
433
       
 
       
      # Since H2O will be hosting the challenges, H2O must be started

     

       
434
       
+
       
      before = builtins.map (certName: "acme-${certName}.service") acmeCertNames.dependent;

     

       
435
       
 
       
      after =

     

       
436
       
 
       
        [ "network.target" ]

     

       
437
       
+
       
        ++ builtins.map (certName: "acme-selfsigned-${certName}.service") acmeCertNames.all

     

       
438
       
+
       
        ++ builtins.map (certName: "acme-${certName}.service") acmeCertNames.independent; # avoid loading self-signed key w/ real cert, or vice-versa

     

       
439
       
 
       


     

       
440
       
 
       
      serviceConfig = {

     

       
441
       
 
       
        ExecStart = "${h2oExe} --mode 'master'";

     
···

       
488
       
 
       
    # of certs end-to-end.

     

       
489
       
 
       
    systemd.services.h2o-config-reload =

     

       
490
       
 
       
      let

     

       
491
       
+
       
        tlsTargets = map (certName: "acme-${certName}.target") acmeCertNames.all;

     

       
492
       
+
       
        tlsServices = map (certName: "acme-${certName}.service") acmeCertNames.all;

     

       
493
       
 
       
      in

     

       
494
       
+
       
      mkIf (acmeCertNames.all != [ ]) {

     

       
495
       
 
       
        wantedBy = tlsServices ++ [ "multi-user.target" ];

     

       
496
       
 
       
        before = tlsTargets;

     

       
497
       
 
       
        after = tlsServices;

     

       
498
       
 
       
        unitConfig = {

     

       
499
       
+
       
          ConditionPathExists = map (

     

       
500
       
+
       
            certName: "${certs.${certName}.directory}/fullchain.pem"

     

       
501
       
+
       
          ) acmeCertNames.all;

     

       
502
       
 
       
          # Disable rate limiting for this since it may be triggered quickly

     

       
503
       
 
       
          # a bunch of times if a lot of certificates are renewed in quick

     

       
504
       
 
       
          # succession. The reload itself is cheap, so even doing a lot of them