From ac51b04b935191ae41f3bfe7cc10e7535cb924d8 Mon Sep 17 00:00:00 2001
From: Alexander Heldt <me@alexanderheldt.se>
Date: Tue, 29 Sep 2026 19:13:50 +0000
Subject: [PATCH] certs: Use lego v5 flag names

lego v5 renamed --dns.propagation-wait to --dns.propagation.wait and
--dns-timeout to --dns.timeout, and exits on the old names, so ordering
or renewing any certificate failed. The six identical cert blocks are
now one definition applied to each domain.
---
 hosts/manatee/modules/certs/default.nix | 92 +++++++------------------
 1 file changed, 25 insertions(+), 67 deletions(-)

diff --git a/hosts/manatee/modules/certs/default.nix b/hosts/manatee/modules/certs/default.nix
index 788ed83..4be7b56 100644
--- a/hosts/manatee/modules/certs/default.nix
+++ b/hosts/manatee/modules/certs/default.nix
@@ -1,4 +1,21 @@
-{ config, ... }:
+{ config, lib, ... }:
+let
+  # Every host is issued the same way: a DNS-01 challenge through Hetzner.
+  hetznerCert = {
+    dnsProvider = "hetzner";
+    environmentFile = config.age.secrets.hetzner-dns.path;
+    group = "nginx";
+
+    # Flag names are lego v5's (v4 spelled them --dns.propagation-wait and
+    # --dns-timeout).
+    extraLegoFlags = [
+      "--dns.resolvers=1.1.1.1:53,8.8.8.8:53"
+      "--dns.propagation.wait=60s" # Wait for 60 seconds for DNS propagation
+      "--dns.timeout=60"
+      "--http-timeout=60"
+    ];
+  };
+in
 {
   security.acme = {
     acceptTerms = true;
@@ -7,72 +24,13 @@
       email = "acme@ppp.pm";
     };
 
-    certs = {
-      "ha.ppp.pm" = {
-        dnsProvider = "hetzner";
-        environmentFile = config.age.secrets.hetzner-dns.path;
-        group = "nginx";
-
-        extraLegoFlags = [
-          "--dns.resolvers=1.1.1.1:53,8.8.8.8:53"
-          "--dns.propagation-wait=60s" # Wait for 60 seconds for DNS propagation
-          "--dns-timeout=60"
-          "--http-timeout=60"
-        ];
-      };
-
-      "komga.ppp.pm" = {
-        dnsProvider = "hetzner";
-        environmentFile = config.age.secrets.hetzner-dns.path;
-        group = "nginx";
-
-        extraLegoFlags = [
-          "--dns.resolvers=1.1.1.1:53,8.8.8.8:53"
-          "--dns.propagation-wait=60s"
-          "--dns-timeout=60"
-          "--http-timeout=60"
-        ];
-      };
-
-      "romm.ppp.pm" = {
-        dnsProvider = "hetzner";
-        environmentFile = config.age.secrets.hetzner-dns.path;
-        group = "nginx";
-
-        extraLegoFlags = [
-          "--dns.resolvers=1.1.1.1:53,8.8.8.8:53"
-          "--dns.propagation-wait=60s"
-          "--dns-timeout=60"
-          "--http-timeout=60"
-        ];
-      };
-
-      "puppy.ppp.pm" = {
-        dnsProvider = "hetzner";
-        environmentFile = config.age.secrets.hetzner-dns.path;
-        group = "nginx";
-
-        extraLegoFlags = [
-          "--dns.resolvers=1.1.1.1:53,8.8.8.8:53"
-          "--dns.propagation-wait=60s"
-          "--dns-timeout=60"
-          "--http-timeout=60"
-        ];
-      };
-
-      "todo.ppp.pm" = {
-        dnsProvider = "hetzner";
-        environmentFile = config.age.secrets.hetzner-dns.path;
-        group = "nginx";
-
-        extraLegoFlags = [
-          "--dns.resolvers=1.1.1.1:53,8.8.8.8:53"
-          "--dns.propagation-wait=60s"
-          "--dns-timeout=60"
-          "--http-timeout=60"
-        ];
-      };
-    };
+    certs = lib.genAttrs [
+      "ha.ppp.pm"
+      "komga.ppp.pm"
+      "romm.ppp.pm"
+      "puppy.ppp.pm"
+      "todo.ppp.pm"
+    ] (_: hetznerCert);
   };
 
   age = {