about summary refs log tree commit diff
path: root/ops/nixos
diff options
context:
space:
mode:
authorVincent Ambo <tazjin@google.com>2020-03-01T01·11+0000
committerVincent Ambo <tazjin@google.com>2020-03-01T01·11+0000
commit814729bd04fd0d9ace4fe9e11d51f960e743adfc (patch)
tree4037f59eeb09788b584ef63aac068106349f6540 /ops/nixos
parent1f5d2d424c94e5c993b47232aff7472fb50d36cb (diff)
fix(ops/nixos/camden): Add required options for ACME updates r/589
The implementation for provisioning ACME certificates has changed in
nixos-unstable[0] and now requires a few extra options to be set.

[0]: https://github.com/NixOS/nixpkgs/pull/77578
Diffstat (limited to 'ops/nixos')
-rw-r--r--ops/nixos/camden/default.nix29
1 files changed, 17 insertions, 12 deletions
diff --git a/ops/nixos/camden/default.nix b/ops/nixos/camden/default.nix
index 9713b148dfe8..45ce3182681a 100644
--- a/ops/nixos/camden/default.nix
+++ b/ops/nixos/camden/default.nix
@@ -156,19 +156,24 @@ in lib.fix(self: {
 
   # Provision a TLS certificate outside of nginx to avoid
   # nixpkgs#38144
-  security.acme.certs."tazj.in" = {
-    user = "nginx";
-    group = "nginx";
-    webroot = "/var/lib/acme/acme-challenge";
-    extraDomains = {
-      "git.tazj.in" = null;
-      "www.tazj.in" = null;
-
-      # Local domains (for this machine only)
-      "camden.tazj.in" = null;
-      "git.camden.tazj.in" = null;
+  security.acme = {
+    acceptTerms = true;
+    email = "mail@tazj.in";
+
+    certs."tazj.in" = {
+      user = "nginx";
+      group = "nginx";
+      webroot = "/var/lib/acme/acme-challenge";
+      extraDomains = {
+        "git.tazj.in" = null;
+        "www.tazj.in" = null;
+
+        # Local domains (for this machine only)
+        "camden.tazj.in" = null;
+        "git.camden.tazj.in" = null;
+      };
+      postRun = "systemctl reload nginx";
     };
-    postRun = "systemctl reload nginx";
   };
 
   # Forward logs to Google Cloud Platform