commit 1cab80242184abf0c5eb44d561272f308693e6da · soopy.moe/gensokyo

+12 -6
systems/koumakan/certificates/default.nix
···

       1
       1
       -
       {...}: {

     

       1
       1
       +
       {_utils, config, ...}: let

     

       2
       2
       +
         secrets = _utils.setupSecrets config {

     

       3
       3
       +
           namespace = "lego";

     

       4
       4
       +
           secrets = ["cf_token"];

     

       5
       5
       +
         };

     

       6
       6
       +
       in {

     

       2
       7
        
         imports = [

     

       3
       8
        
           ./global.nix

     

       4
       9
        
           ./postgresql.nix

     

       5
       10
        
           ./fediverse.nix

     

       6
       11
        
           ./proxy.nix

     

       12
       12
       +
           secrets.generate

     

       7
       13
        
         ];

     

       8
       14
        
       

     

       9
       15
        
         security.acme = {

     

       10
       16
        
           defaults = {

     

       11
       17
        
             # == lego Configuration ==

     

       12
       12
       -
             credentialsFile = "/etc/lego/desec";

     

       13
       13
       -
             dnsProvider = "desec";

     

       14
       14
       -
             # In a more ideal world we would have an eddsa algo here but oh well

     

       18
       18
       +
             credentialFiles = {

     

       19
       19
       +
               CLOUDFLARE_API_KEY = secrets.get "cf_token";

     

       20
       20
       +
             };

     

       21
       21
       +
             dnsProvider = "cloudflare";

     

       22
       22
       +
             # In an ideal world we would have an ed/cv25519 algo here but oh well

     

       15
       23
        
             keyType = "ec256"; # Ensure we use ec keys

     

       16
       16
       -
       

     

       17
       17
       -
             dnsResolver = "8.8.8.8:53";

     

       18
       24
        
       

     

       19
       25
        
             # == LE Configuration ==

     

       20
       26
        
             email = "me@soopy.moe";