diff options
| author | Vincent Ambo <tazjin@google.com> | 2020-03-01T01·11+0000 |
|---|---|---|
| committer | Vincent Ambo <tazjin@google.com> | 2020-03-01T01·11+0000 |
| commit | 814729bd04fd0d9ace4fe9e11d51f960e743adfc (patch) | |
| tree | 4037f59eeb09788b584ef63aac068106349f6540 /ops | |
| parent | 1f5d2d424c94e5c993b47232aff7472fb50d36cb (diff) | |
fix(ops/nixos/camden): Add required options for ACME updates r/589
The implementation for provisioning ACME certificates has changed in nixos-unstable[0] and now requires a few extra options to be set. [0]: https://github.com/NixOS/nixpkgs/pull/77578
Diffstat (limited to 'ops')
| -rw-r--r-- | ops/nixos/camden/default.nix | 29 |
1 files changed, 17 insertions, 12 deletions
diff --git a/ops/nixos/camden/default.nix b/ops/nixos/camden/default.nix index 9713b148dfe8..45ce3182681a 100644 --- a/ops/nixos/camden/default.nix +++ b/ops/nixos/camden/default.nix @@ -156,19 +156,24 @@ in lib.fix(self: { # Provision a TLS certificate outside of nginx to avoid # nixpkgs#38144 - security.acme.certs."tazj.in" = { - user = "nginx"; - group = "nginx"; - webroot = "/var/lib/acme/acme-challenge"; - extraDomains = { - "git.tazj.in" = null; - "www.tazj.in" = null; - - # Local domains (for this machine only) - "camden.tazj.in" = null; - "git.camden.tazj.in" = null; + security.acme = { + acceptTerms = true; + email = "mail@tazj.in"; + + certs."tazj.in" = { + user = "nginx"; + group = "nginx"; + webroot = "/var/lib/acme/acme-challenge"; + extraDomains = { + "git.tazj.in" = null; + "www.tazj.in" = null; + + # Local domains (for this machine only) + "camden.tazj.in" = null; + "git.camden.tazj.in" = null; + }; + postRun = "systemctl reload nginx"; }; - postRun = "systemctl reload nginx"; }; # Forward logs to Google Cloud Platform |