pyrox.dev
+123
-105
nixos/modules/security/acme.nix
+123
-105
nixos/modules/security/acme.nix
············-echo 1>&2 "nixos-acme: Ignoring failed renewal because expiration isn't within the coming ${toString cfg.validMinDays} days"···${optionalString (cfg.preliminarySelfsigned) "Selfsigned certs are in place and dependant services will still start."}···-enableDebugLogs = mkEnableOption "debug logging for this certificate" // { default = cfg.enableDebugLogs; };····································-enableDebugLogs = mkEnableOption "debug logging for all certificates by default" // { default = true; };······(mkRemovedOptionModule [ "security" "acme" "directory" ] "ACME Directory is now hardcoded to /var/lib/acme and its permisisons are managed by systemd. See https://github.com/NixOS/nixpkgs/issues/53852 for more info.")(mkRemovedOptionModule [ "security" "acme" "preDelay" ] "This option has been removed. If you want to make sure that something executes before certificates are provisioned, add a RequiredBy=acme-\${cert}.service to the service you want to execute before the cert renewal")(mkRemovedOptionModule [ "security" "acme" "activationDelay" ] "This option has been removed. If you want to make sure that something executes before certificates are provisioned, add a RequiredBy=acme-\${cert}.service to the service you want to execute before the cert renewal")-(mkChangedOptionModule [ "security" "acme" "validMin" ] [ "security" "acme" "validMinDays" ] (config: config.security.acme.validMin / (24 * 3600)))
············+echo 1>&2 "nixos-acme: Ignoring failed renewal because expiration isn't within the coming ${toString data.validMinDays} days"···${optionalString (cfg.preliminarySelfsigned) "Selfsigned certs are in place and dependant services will still start."}·······································+options = (inheritableOpts { inherit (cfg) defaults; inheritDefaults = cfg.certs."${name}".inheritDefaults; }) // {······(mkRemovedOptionModule [ "security" "acme" "directory" ] "ACME Directory is now hardcoded to /var/lib/acme and its permisisons are managed by systemd. See https://github.com/NixOS/nixpkgs/issues/53852 for more info.")(mkRemovedOptionModule [ "security" "acme" "preDelay" ] "This option has been removed. If you want to make sure that something executes before certificates are provisioned, add a RequiredBy=acme-\${cert}.service to the service you want to execute before the cert renewal")(mkRemovedOptionModule [ "security" "acme" "activationDelay" ] "This option has been removed. If you want to make sure that something executes before certificates are provisioned, add a RequiredBy=acme-\${cert}.service to the service you want to execute before the cert renewal")+(mkChangedOptionModule [ "security" "acme" "validMin" ] [ "security" "acme" "defaults" "validMinDays" ] (config: config.security.acme.validMin / (24 * 3600)))+(mkChangedOptionModule [ "security" "acme" "validMinDays" ] [ "security" "acme" "defaults" "validMinDays" ] (config: config.security.acme.validMinDays))+(mkChangedOptionModule [ "security" "acme" "renewInterval" ] [ "security" "acme" "defaults" "renewInterval" ] (config: config.security.acme.renewInterval))+(mkChangedOptionModule [ "security" "acme" "email" ] [ "security" "acme" "defaults" "email" ] (config: config.security.acme.email))+(mkChangedOptionModule [ "security" "acme" "server" ] [ "security" "acme" "defaults" "server" ] (config: config.security.acme.server))+(mkChangedOptionModule [ "security" "acme" "enableDebugLogs" ] [ "security" "acme" "defaults" "enableDebugLogs" ] (config: config.security.acme.enableDebugLogs))
+10
-3
nixos/modules/services/web-servers/apache-httpd/default.nix
+10
-3
nixos/modules/services/web-servers/apache-httpd/default.nix
······
······
+5
-2
nixos/modules/services/web-servers/apache-httpd/vhost-options.nix
+5
-2
nixos/modules/services/web-servers/apache-httpd/vhost-options.nix
···
+10
-3
nixos/modules/services/web-servers/nginx/default.nix
+10
-3
nixos/modules/services/web-servers/nginx/default.nix
······
······
+6
-3
nixos/modules/services/web-servers/nginx/vhost-options.nix
+6
-3
nixos/modules/services/web-servers/nginx/vhost-options.nix
······-description = "Directory for the acme challenge which is PUBLIC, don't put certs or keys in here";
······
+276
-221
nixos/tests/acme.nix
+276
-221
nixos/tests/acme.nix
························'curl --data \'{"host": "${caDomain}", "addresses": ["${nodes.acme.config.networking.primaryIPAddress}"]}\' http://${dnsServerIP nodes}:8055/add-a'f"test $(stat -L -c '%a %U %G' /var/lib/acme/a.example.test/*.pem | tee /dev/stderr | grep '640 acme {group}' | wc -l) -eq 5"···f"test $(find /var/lib/acme/accounts -type f -exec stat -L -c '%a %U %G' {{}} \\; | tee /dev/stderr | grep -v '600 acme {group}' | wc -l) -eq 0"# Selfsigned certs tests happen late so we aren't fighting the system init triggering cert renewal···
······+# Test that server reloads when an alias is removed (and subsequently test removal works in acme)··················'curl --data \'{"host": "${caDomain}", "addresses": ["${nodes.acme.config.networking.primaryIPAddress}"]}\' http://${dnsServerIP nodes}:8055/add-a'f"test $(stat -L -c '%a %U %G' /var/lib/acme/a.example.test/*.pem | tee /dev/stderr | grep '640 acme {group}' | wc -l) -eq 5"···f"test $(find /var/lib/acme/accounts -type f -exec stat -L -c '%a %U %G' {{}} \\; | tee /dev/stderr | grep -v '600 acme {group}' | wc -l) -eq 0"# Selfsigned certs tests happen late so we aren't fighting the system init triggering cert renewal···
+4
-2
nixos/tests/common/acme/client/default.nix
+4
-2
nixos/tests/common/acme/client/default.nix
+5
nixos/tests/common/acme/server/default.nix
+5
nixos/tests/common/acme/server/default.nix
···