Alexander Heldt
154f33f258
Served at dagbok.ppp.pm through nginx from 127.0.0.1:8093, with its token from agenix, a Hetzner DNS-01 certificate, a dynamic DNS record and a state backup snapshot.
44 lines
952 B
Nix
44 lines
952 B
Nix
{ config, lib, ... }:
|
|
let
|
|
# Every host is issued the same way: a DNS-01 challenge through Hetzner.
|
|
hetznerCert = {
|
|
dnsProvider = "hetzner";
|
|
environmentFile = config.age.secrets.hetzner-dns.path;
|
|
group = "nginx";
|
|
|
|
# Flag names are lego v5's (v4 spelled them --dns.propagation-wait and
|
|
# --dns-timeout).
|
|
extraLegoFlags = [
|
|
"--dns.resolvers=1.1.1.1:53,8.8.8.8:53"
|
|
"--dns.propagation.wait=60s" # Wait for 60 seconds for DNS propagation
|
|
"--dns.timeout=60"
|
|
"--http-timeout=60"
|
|
];
|
|
};
|
|
in
|
|
{
|
|
security.acme = {
|
|
acceptTerms = true;
|
|
|
|
defaults = {
|
|
email = "acme@ppp.pm";
|
|
};
|
|
|
|
certs = lib.genAttrs [
|
|
"ha.ppp.pm"
|
|
"komga.ppp.pm"
|
|
"romm.ppp.pm"
|
|
"puppy.ppp.pm"
|
|
"todo.ppp.pm"
|
|
"schema.ppp.pm"
|
|
"dagbok.ppp.pm"
|
|
] (_: hetznerCert);
|
|
};
|
|
|
|
age = {
|
|
secrets = {
|
|
"hetzner-dns".file = ../../../../secrets/manatee/hetzner-dns.age;
|
|
};
|
|
};
|
|
}
|