mirrors_public/oddlama_nix-config
1
1
Fork 1
mirror of https://github.com/oddlama/nix-config.git synced 2025-10-11 07:10:39 +02:00
Code Activity

feat: activate acme on sentinel

Browse source
This commit is contained in:
oddlama 2023-05-31 18:06:53 +02:00
parent 4fd369f034
commit ef03fd0594
No known key found for this signature in database
GPG key ID: 14EFE510775FE39A
1 changed files with 45 additions and 39 deletions
Download patch file Download diff file Expand all files Collapse all files

84
hosts/sentinel/nginx.nix
View file

@ -1,51 +1,57 @@
{config, ...}: let
{
config,
nodes,
...
}: let
inherit (config.repo.secrets.local) acme personalDomain;
in {
networking.domain = personalDomain;
rekey.secrets."dhparams.pem" = {
file = ./secrets/dhparams.pem.age;
mode = "440";
group = "nginx";
};
rekey.secrets.acme-credentials = {
file = ./secrets/acme-credentials.age;
mode = "440";
group = "acme";
};
#security.acme = {
# acceptTerms = true;
# defaults = {
# inherit (acme) email;
# credentialsFile = config.rekey.secrets.acme-credentials.path;
# dnsProvider = "cloudflare";
# dnsPropagationCheck = true;
# reloadServices = ["nginx"];
# };
#};
#extra.acme.wildcardDomains = acme.domains;
#users.groups.acme.members = ["nginx"];
security.acme = {
acceptTerms = true;
defaults = {
inherit (acme) email;
credentialsFile = config.rekey.secrets.acme-credentials.path;
dnsProvider = "cloudflare";
dnsPropagationCheck = true;
reloadServices = ["nginx"];
};
};
extra.acme.wildcardDomains = acme.domains;
users.groups.acme.members = ["nginx"];
#services.nginx = {
# enable = true;
# upstreams."kanidm" = {
# servers."${config.extra.wireguard."${parentNodeName}-local-vms".ipv4}:8300" = {};
# extraConfig = ''
# zone kanidm 64k;
# keepalive 2;
# '';
# };
# virtualHosts.${authDomain} = {
# forceSSL = true;
# useACMEHost = config.lib.extra.matchingWildcardCert authDomain;
# locations."/".proxyPass = "https://kanidm";
# # Allow using self-signed certs to satisfy kanidm's requirement
# # for TLS connections. (This is over wireguard anyway)
# extraConfig = ''
# proxy_ssl_verify off;
# '';
# };
#};
rekey.secrets."dhparams.pem" = {
file = ./secrets/dhparams.pem.age;
mode = "440";
group = "nginx";
};
services.nginx = let
authDomain = nodes.ward-nginx.config.services.kanidm.serverSettings.domain;
in {
enable = true;
upstreams."kanidm" = {
servers."${nodes.ward-nginx.config.extra.wireguard.proxy-sentinel.ipv4}:8300" = {};
extraConfig = ''
zone kanidm 64k;
keepalive 2;
'';
};
virtualHosts.${authDomain} = {
forceSSL = true;
useACMEHost = config.lib.extra.matchingWildcardCert authDomain;
locations."/".proxyPass = "https://kanidm";
# Allow using self-signed certs to satisfy kanidm's requirement
# for TLS connections. (This is over wireguard anyway)
extraConfig = ''
proxy_ssl_verify off;
'';
};
};
}