···

       
24
       
 
       
  # Since that service is a oneshot with RemainAfterExit,

     

       
25
       
 
       
  # the folder will exist during all renewal services.

     

       
26
       
 
       
  lockdir = "/run/acme/";

     

       
27
       
-
       
  concurrencyLockfiles = map (n: "${toString n}.lock") (lib.range 1 cfg.maxConcurrentRenewals);

     

       
28
       
-
       
  # Assign elements of `baseList` to each element of `needAssignmentList`, until the latter is exhausted.

     

       
29
       
-
       
  # returns: [{fst = "element of baseList"; snd = "element of needAssignmentList"}]

     

       
30
       
-
       
  roundRobinAssign =

     

       
31
       
-
       
    baseList: needAssignmentList:

     

       
32
       
-
       
    if baseList == [ ] then [ ] else _rrCycler baseList baseList needAssignmentList;

     

       
33
       
-
       
  _rrCycler =

     

       
34
       
-
       
    with builtins;

     

       
35
       
-
       
    origBaseList: workingBaseList: needAssignmentList:

     

       
36
       
-
       
    if (workingBaseList == [ ] || needAssignmentList == [ ]) then

     

       
37
       
-
       
      [ ]

     

       
38
       
-
       
    else

     

       
39
       
-
       
      [

     

       
40
       
-
       
        {

     

       
41
       
-
       
          fst = head workingBaseList;

     

       
42
       
-
       
          snd = head needAssignmentList;

     

       
43
       
-
       
        }

     

       
44
       
-
       
      ]

     

       
45
       
-
       
      ++ _rrCycler origBaseList (

     

       
46
       
-
       
        if (tail workingBaseList == [ ]) then origBaseList else tail workingBaseList

     

       
47
       
-
       
      ) (tail needAssignmentList);

     

       
48
       
-
       
  attrsToList = lib.mapAttrsToList (

     

       
49
       
-
       
    attrname: attrval: {

     

       
50
       
-
       
      name = attrname;

     

       
51
       
-
       
      value = attrval;

     

       
52
       
-
       
    }

     

       
53
       
-
       
  );

     

       
54
       
-
       
  # for an AttrSet `funcsAttrs` having functions as values, apply single arguments from

     

       
55
       
-
       
  # `argsList` to them in a round-robin manner.

     

       
56
       
-
       
  # Returns an attribute set with the applied functions as values.

     

       
57
       
-
       
  roundRobinApplyAttrs =

     

       
58
       
-
       
    funcsAttrs: argsList:

     

       
59
       
-
       
    lib.listToAttrs (

     

       
60
       
-
       
      map (x: {

     

       
61
       
-
       
        inherit (x.snd) name;

     

       
62
       
-
       
        value = x.snd.value x.fst;

     

       
63
       
-
       
      }) (roundRobinAssign argsList (attrsToList funcsAttrs))

     

       
64
       
-
       
    );

     

       
65
       
 
       
  wrapInFlock =

     

       
66
       
-
       
    lockfilePath: script:

     

       
67
       
 
       
    # explainer: https://stackoverflow.com/a/60896531

     

       
68
       
 
       
    ''

     

       
69
       
-
       
      exec {LOCKFD}> ${lockfilePath}

     

       
70
       
-
       
      echo "Waiting to acquire lock ${lockfilePath}"

     

       
71
       
-
       
      ${pkgs.flock}/bin/flock ''${LOCKFD} || exit 1

     

       
72
       
-
       
      echo "Acquired lock ${lockfilePath}"

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
73
       
 
       
    ''

     

       
74
       
-
       
    + script

     

       
75
       
-
       
    + "\n"

     

       
76
       
-
       
    + ''echo "Releasing lock ${lockfilePath}"  # only released after process exit'';

     

       
77
       
 
       


     

       
78
       
 
       
  # There are many services required to make cert renewals work.

     

       
79
       
 
       
  # They all follow a common structure:

     
···

       
356
       
 
       
        };

     

       
357
       
 
       
      };

     

       
358
       
 
       


     

       
359
       
-
       
      baseService = lockfileName: {

     

       
360
       
 
       
        description = "Ensure certificate for ${cert}";

     

       
361
       
 
       


     

       
362
       
 
       
        wantedBy = [ "multi-user.target" ];

     
···

       
399
       
 
       
        # Working directory will be /tmp

     

       
400
       
 
       
        # minica will output to a folder sharing the name of the first domain

     

       
401
       
 
       
        # in the list, which will be ${data.domain}

     

       
402
       
-
       
        script = (if (lockfileName == null) then lib.id else wrapInFlock "${lockdir}${lockfileName}") ''

     

       
403
       
 
       
          set -ex

     

       
404
       
 
       


     

       
405
       
 
       
          # Regenerate self-signed certificates (in case the SANs change) until we

     
···

       
447
       
 
       
        '';

     

       
448
       
 
       
      };

     

       
449
       
 
       


     

       
450
       
-
       
      orderRenewService = lockfileName: {

     

       
451
       
 
       
        description = "Order (and renew) ACME certificate for ${cert}";

     

       
452
       
 
       
        after = [

     

       
453
       
 
       
          "network.target"

     
···

       
528
       
 
       
              };

     

       
529
       
 
       


     

       
530
       
 
       
        # Working directory will be /tmp

     

       
531
       
-
       
        script = (if (lockfileName == null) then lib.id else wrapInFlock "${lockdir}${lockfileName}") ''

     

       
532
       
 
       
          ${lib.optionalString data.enableDebugLogs "set -x"}

     

       
533
       
 
       
          set -euo pipefail

     

       
534
       
 
       


     
···

       
1179
       
 
       


     

       
1180
       
 
       
      systemd.services =

     

       
1181
       
 
       
        let

     

       
1182
       
-
       
          orderRenewServiceFunctions = lib.mapAttrs' (

     

       
1183
       
 
       
            cert: conf: lib.nameValuePair "acme-order-renew-${cert}" conf.orderRenewService

     

       
1184
       
 
       
          ) certConfigs;

     

       
1185
       
-
       
          orderRenewServices =

     

       
1186
       
-
       
            if cfg.maxConcurrentRenewals > 0 then

     

       
1187
       
-
       
              roundRobinApplyAttrs orderRenewServiceFunctions concurrencyLockfiles

     

       
1188
       
-
       
            else

     

       
1189
       
-
       
              lib.mapAttrs (_: f: f null) orderRenewServiceFunctions;

     

       
1190
       
-
       
          baseServiceFunctions = lib.mapAttrs' (

     

       
1191
       
 
       
            cert: conf: lib.nameValuePair "acme-${cert}" conf.baseService

     

       
1192
       
 
       
          ) certConfigs;

     

       
1193
       
-
       
          baseServices =

     

       
1194
       
-
       
            if cfg.maxConcurrentRenewals > 0 then

     

       
1195
       
-
       
              roundRobinApplyAttrs baseServiceFunctions concurrencyLockfiles

     

       
1196
       
-
       
            else

     

       
1197
       
-
       
              lib.mapAttrs (_: f: f null) baseServiceFunctions;

     

       
1198
       
 
       
        in

     

       
1199
       
 
       
        {

     

       
1200
       
 
       
          acme-setup = setupService;

     

···

       
24
       
 
       
  # Since that service is a oneshot with RemainAfterExit,

     

       
25
       
 
       
  # the folder will exist during all renewal services.

     

       
26
       
 
       
  lockdir = "/run/acme/";

     

       
27
       
+
       


     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
28
       
 
       
  wrapInFlock =

     

       
29
       
+
       
    script:

     

       
30
       
 
       
    # explainer: https://stackoverflow.com/a/60896531

     

       
31
       
 
       
    ''

     

       
32
       
+
       
      maxConcurrentRenewals=${toString cfg.maxConcurrentRenewals}

     

       
33
       
+
       


     

       
34
       
+
       
      acquireLock() {

     

       
35
       
+
       
        echo "Waiting to acquire lock in ${lockdir}"

     

       
36
       
+
       
        while true; do

     

       
37
       
+
       
          for i in $(seq 1 $maxConcurrentRenewals); do

     

       
38
       
+
       
            exec {LOCKFD}> "${lockdir}/$i.lock"

     

       
39
       
+
       
            if ${pkgs.flock}/bin/flock -n ''${LOCKFD}; then

     

       
40
       
+
       
              return 0

     

       
41
       
+
       
            fi

     

       
42
       
+
       
            exec {LOCKFD}>&-

     

       
43
       
+
       
          done

     

       
44
       
+
       
          sleep 1;

     

       
45
       
+
       
        done

     

       
46
       
+
       
      }

     

       
47
       
+
       


     

       
48
       
+
       
      if [ "$maxConcurrentRenewals" -gt "0" ]; then

     

       
49
       
+
       
        acquireLock

     

       
50
       
+
       
      fi

     

       
51
       
 
       
    ''

     

       
52
       
+
       
    + script;

     

       
0
       
 
       

     

       
0
       
 
       

     

       
53
       
 
       


     

       
54
       
 
       
  # There are many services required to make cert renewals work.

     

       
55
       
 
       
  # They all follow a common structure:

     
···

       
332
       
 
       
        };

     

       
333
       
 
       
      };

     

       
334
       
 
       


     

       
335
       
+
       
      baseService = {

     

       
336
       
 
       
        description = "Ensure certificate for ${cert}";

     

       
337
       
 
       


     

       
338
       
 
       
        wantedBy = [ "multi-user.target" ];

     
···

       
375
       
 
       
        # Working directory will be /tmp

     

       
376
       
 
       
        # minica will output to a folder sharing the name of the first domain

     

       
377
       
 
       
        # in the list, which will be ${data.domain}

     

       
378
       
+
       
        script = wrapInFlock ''

     

       
379
       
 
       
          set -ex

     

       
380
       
 
       


     

       
381
       
 
       
          # Regenerate self-signed certificates (in case the SANs change) until we

     
···

       
423
       
 
       
        '';

     

       
424
       
 
       
      };

     

       
425
       
 
       


     

       
426
       
+
       
      orderRenewService = {

     

       
427
       
 
       
        description = "Order (and renew) ACME certificate for ${cert}";

     

       
428
       
 
       
        after = [

     

       
429
       
 
       
          "network.target"

     
···

       
504
       
 
       
              };

     

       
505
       
 
       


     

       
506
       
 
       
        # Working directory will be /tmp

     

       
507
       
+
       
        script = wrapInFlock ''

     

       
508
       
 
       
          ${lib.optionalString data.enableDebugLogs "set -x"}

     

       
509
       
 
       
          set -euo pipefail

     

       
510
       
 
       


     
···

       
1155
       
 
       


     

       
1156
       
 
       
      systemd.services =

     

       
1157
       
 
       
        let

     

       
1158
       
+
       
          orderRenewServices = lib.mapAttrs' (

     

       
1159
       
 
       
            cert: conf: lib.nameValuePair "acme-order-renew-${cert}" conf.orderRenewService

     

       
1160
       
 
       
          ) certConfigs;

     

       
1161
       
+
       
          baseServices = lib.mapAttrs' (

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
1162
       
 
       
            cert: conf: lib.nameValuePair "acme-${cert}" conf.baseService

     

       
1163
       
 
       
          ) certConfigs;

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
1164
       
 
       
        in

     

       
1165
       
 
       
        {

     

       
1166
       
 
       
          acme-setup = setupService;