Switch nixos.org to a Let's Encrypt certificate
... since the current StartSSL certificate expires tomorrow. Many thanks to @fpletz for providing the ACME module!
Eelco Dolstra committed
Apr 7, 2016 at 17:41 UTC
19b956005ab850dcfc0112288e5a0c3f808c05f0
1 file changed
+33
-5
nixos-org/webserver.nix
+33
-5
@@ -6,6 +6,9 @@ let
6
7
sshKeys = import ../ssh-keys.nix;
8
9
+ acmeKeyDir = "/var/lib/acme/nixos.org";
10
+ acmeWebRoot = "/var/lib/httpd/acme";
11
+
12
nixosRelease = "16.03";
13
14
nixosVHostConfig =
@@ -23,6 +26,9 @@ let
26
{ urlPath = "/releases";
27
dir = "/releases";
28
}
29
+ { urlPath = "/.well-known/acme-challenge";
30
+ dir = "${acmeWebRoot}/.well-known/acme-challenge";
31
+ }
32
];
33
34
robotsEntries =
@@ -78,7 +84,6 @@ in
84
security.pam.enableSSHAgentAuth = true;
85
86
services.httpd = {
81
- package = pkgs.apacheHttpd_2_2;
87
enable = true;
88
#multiProcessingModule = "worker";
89
logPerVirtualHost = true;
@@ -120,9 +125,8 @@ in
125
126
(nixosVHostConfig // {
127
enableSSL = true;
123
- sslServerCert = "/root/ssl-secrets/ssl-nixos-org.crt";
124
- sslServerKey = "/root/ssl-secrets/ssl-nixos-org.key";
125
- sslServerChain = ./sub.class1.server.ca.pem;
128
+ sslServerKey = "${acmeKeyDir}/key.pem";
129
+ sslServerCert = "${acmeKeyDir}/fullchain.pem";
130
extraConfig = nixosVHostConfig.extraConfig +
131
''
132
SSLProtocol All -SSLv2 -SSLv3
@@ -131,7 +135,8 @@ in
135
#SSLOpenSSLConfCmd DHParameters "${./dhparams.pem}"
136
'';
137
extraSubservices =
134
- [ { function = import <services/subversion>;
138
+ [ /*
139
+ { function = import <services/subversion>;
140
id = "nix";
141
urlPrefix = "";
142
toplevelRedirect = false;
@@ -143,6 +148,7 @@ in
148
logo = "/logo/nixos-lores.png";
149
};
150
}
151
+ */
152
{ serviceType = "mediawiki";
153
siteName = "Nix Wiki";
154
logo = "/logo/nix-wiki.png";
@@ -353,4 +359,26 @@ in
359
360
nix.gc.automatic = true;
361
362
+ # Let's Encrypt configuration.
363
+ security.acme.certs."nixos.org" =
364
+ { email = "edolstra@gmail.com";
365
+ webroot = acmeWebRoot;
366
+ postRun = "systemctl reload httpd.service";
367
+ };
368
+
369
+ # Generate a dummy self-signed certificate until we get one from
370
+ # Let's Encrypt.
371
+ system.activationScripts.createDummyKey =
372
+ ''
373
+ dir=${acmeKeyDir}
374
+ mkdir -m 0700 -p $dir
375
+ if ! [[ -e $dir/key.pem ]]; then
376
+ ${pkgs.openssl}/bin/openssl genrsa -passout pass:foo -des3 -out $dir/key-in.pem 1024
377
+ ${pkgs.openssl}/bin/openssl req -passin pass:foo -new -key $dir/key-in.pem -out $dir/key.csr \
378
+ -subj "/C=NL/ST=Denial/L=Springfield/O=Dis/CN=www.example.com"
379
+ ${pkgs.openssl}/bin/openssl rsa -passin pass:foo -in $dir/key-in.pem -out $dir/key.pem
380
+ ${pkgs.openssl}/bin/openssl x509 -req -days 365 -in $dir/key.csr -signkey $dir/key.pem -out $dir/fullchain.pem
381
+ fi
382
+ '';
383
+
384
}