alex/nixos-configs
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

certs: Use lego v5 flag names

Browse Source 
lego v5 renamed --dns.propagation-wait to --dns.propagation.wait and
--dns-timeout to --dns.timeout, and exits on the old names, so ordering
or renewing any certificate failed. The six identical cert blocks are
now one definition applied to each domain.
This commit is contained in:
Alexander Heldt committed 2026-09-30 07:33:57 +00:00
1 parent 17885cf054
commit ac51b04b93
1 file changed
+25 -67
Download Patch File Download Diff File Expand all files Collapse all files
hosts/manatee/modules/certs/default.nix
+25 -67
View File
@@ -1,4 +1,21 @@
{ config, ... }:
{ config, lib, ... }:
let
# Every host is issued the same way: a DNS-01 challenge through Hetzner.
hetznerCert = {
dnsProvider = "hetzner";
environmentFile = config.age.secrets.hetzner-dns.path;
group = "nginx";
# Flag names are lego v5's (v4 spelled them --dns.propagation-wait and
# --dns-timeout).
extraLegoFlags = [
"--dns.resolvers=1.1.1.1:53,8.8.8.8:53"
"--dns.propagation.wait=60s" # Wait for 60 seconds for DNS propagation
"--dns.timeout=60"
"--http-timeout=60"
];
};
in
{
security.acme = {
acceptTerms = true;
@@ -7,72 +24,13 @@
email = "acme@ppp.pm";
};
certs = {
"ha.ppp.pm" = {
dnsProvider = "hetzner";
environmentFile = config.age.secrets.hetzner-dns.path;
group = "nginx";
extraLegoFlags = [
"--dns.resolvers=1.1.1.1:53,8.8.8.8:53"
"--dns.propagation-wait=60s" # Wait for 60 seconds for DNS propagation
"--dns-timeout=60"
"--http-timeout=60"
];
};
"komga.ppp.pm" = {
dnsProvider = "hetzner";
environmentFile = config.age.secrets.hetzner-dns.path;
group = "nginx";
extraLegoFlags = [
"--dns.resolvers=1.1.1.1:53,8.8.8.8:53"
"--dns.propagation-wait=60s"
"--dns-timeout=60"
"--http-timeout=60"
];
};
"romm.ppp.pm" = {
dnsProvider = "hetzner";
environmentFile = config.age.secrets.hetzner-dns.path;
group = "nginx";
extraLegoFlags = [
"--dns.resolvers=1.1.1.1:53,8.8.8.8:53"
"--dns.propagation-wait=60s"
"--dns-timeout=60"
"--http-timeout=60"
];
};
"puppy.ppp.pm" = {
dnsProvider = "hetzner";
environmentFile = config.age.secrets.hetzner-dns.path;
group = "nginx";
extraLegoFlags = [
"--dns.resolvers=1.1.1.1:53,8.8.8.8:53"
"--dns.propagation-wait=60s"
"--dns-timeout=60"
"--http-timeout=60"
];
};
"todo.ppp.pm" = {
dnsProvider = "hetzner";
environmentFile = config.age.secrets.hetzner-dns.path;
group = "nginx";
extraLegoFlags = [
"--dns.resolvers=1.1.1.1:53,8.8.8.8:53"
"--dns.propagation-wait=60s"
"--dns-timeout=60"
"--http-timeout=60"
];
};
};
certs = lib.genAttrs [
"ha.ppp.pm"
"komga.ppp.pm"
"romm.ppp.pm"
"puppy.ppp.pm"
"todo.ppp.pm"
] (_: hetznerCert);
};
age = {