Simplify ACME
Eelco Dolstra committed
Oct 13, 2020 at 14:01 UTC
489b8b212a811506b7991cdc545cc039b21c1957
1 file changed
+1
-34
delft/hydra-proxy.nix
+1
-34
@@ -30,9 +30,6 @@ let
30
</Location>
31
'';
32
33
- acmeKeyDir = "/var/lib/acme/hydra.nixos.org";
34
- acmeWebRoot = "/var/lib/httpd/acme";
35
-
33
in
34
35
{
@@ -50,8 +47,7 @@ in
47
48
virtualHosts."hydra.nixos.org" =
49
{ addSSL = true;
53
- sslServerKey = "${acmeKeyDir}/key.pem";
54
- sslServerCert = "${acmeKeyDir}/fullchain.pem";
50
+ enableACME = true;
51
extraConfig = ''
52
# Required by Catalyst.
53
RequestHeader set X-Forwarded-Proto https
@@ -62,38 +58,9 @@ in
58
[ { urlPath = "/apache-errors";
59
dir = ./apache-errors;
60
}
65
- { urlPath = "/.well-known/acme-challenge";
66
- dir = "${acmeWebRoot}/.well-known/acme-challenge";
67
- }
61
];
62
};
63
64
};
65
73
- # Ensure that httpd can read the SSL certificates.
74
- systemd.services.httpd.serviceConfig.User = lib.mkForce "root";
75
-
76
- # Let's Encrypt configuration.
77
- security.acme.acceptTerms = true;
78
- security.acme.certs."hydra.nixos.org" =
79
- { email = "edolstra@gmail.com";
80
- webroot = acmeWebRoot;
81
- postRun = "systemctl reload httpd.service";
82
- };
83
-
84
- # Generate a dummy self-signed certificate until we get one from
85
- # Let's Encrypt.
86
- system.activationScripts.createDummyKey =
87
- ''
88
- dir=${acmeKeyDir}
89
- mkdir -m 0700 -p $dir
90
- if ! [[ -e $dir/key.pem ]]; then
91
- ${pkgs.openssl}/bin/openssl genrsa -passout pass:foo -des3 -out $dir/key-in.pem 1024
92
- ${pkgs.openssl}/bin/openssl req -passin pass:foo -new -key $dir/key-in.pem -out $dir/key.csr \
93
- -subj "/C=NL/ST=Denial/L=Springfield/O=Dis/CN=www.example.com"
94
- ${pkgs.openssl}/bin/openssl rsa -passin pass:foo -in $dir/key-in.pem -out $dir/key.pem
95
- ${pkgs.openssl}/bin/openssl x509 -req -days 365 -in $dir/key.csr -signkey $dir/key.pem -out $dir/fullchain.pem
96
- fi
97
- '';
98
-
66
}