Remove ACME stuff
Eelco Dolstra committed
Oct 26, 2020 at 12:27 UTC
a0b3a0cb0dcbfb1aa7725e4fdbb5939c9d1adcd9
1 file changed
+2
-30
ngi0/hydra/hydra-proxy.nix
+2
-30
@@ -30,9 +30,6 @@ let
30
</Location>
31
'';
32
33
- acmeKeyDir = "/var/lib/acme/hydra.ngi0.nixos.org";
34
- acmeWebRoot = "/var/lib/httpd/acme";
35
-
33
in
34
35
{
@@ -50,8 +47,7 @@ in
47
48
virtualHosts."hydra.ngi0.nixos.org" =
49
{ addSSL = true;
53
- sslServerKey = "${acmeKeyDir}/key.pem";
54
- sslServerCert = "${acmeKeyDir}/fullchain.pem";
50
+ enableACME = true;
51
extraConfig = ''
52
# Required by Catalyst.
53
RequestHeader set X-Forwarded-Proto https
@@ -62,35 +58,11 @@ in
58
[ { urlPath = "/apache-errors";
59
dir = ../../delft/apache-errors;
60
}
65
- { urlPath = "/.well-known/acme-challenge";
66
- dir = "${acmeWebRoot}/.well-known/acme-challenge";
67
- }
61
];
62
};
63
64
};
65
73
- # Let's Encrypt configuration.
66
security.acme.acceptTerms = true;
75
- security.acme.certs."hydra.ngi0.nixos.org" =
76
- { email = "ngi@nixos.org";
77
- webroot = acmeWebRoot;
78
- postRun = "systemctl reload httpd.service";
79
- };
80
-
81
- # Generate a dummy self-signed certificate until we get one from
82
- # Let's Encrypt.
83
- system.activationScripts.createDummyKey =
84
- ''
85
- dir=${acmeKeyDir}
86
- mkdir -m 0700 -p $dir
87
- if ! [[ -e $dir/key.pem ]]; then
88
- ${pkgs.openssl}/bin/openssl genrsa -passout pass:foobar -des3 -out $dir/key-in.pem 1024
89
- ${pkgs.openssl}/bin/openssl req -passin pass:foobar -new -key $dir/key-in.pem -out $dir/key.csr \
90
- -subj "/C=NL/ST=Denial/L=Springfield/O=Dis/CN=www.example.com"
91
- ${pkgs.openssl}/bin/openssl rsa -passin pass:foobar -in $dir/key-in.pem -out $dir/key.pem
92
- ${pkgs.openssl}/bin/openssl x509 -req -days 365 -in $dir/key.csr -signkey $dir/key.pem -out $dir/fullchain.pem
93
- fi
94
- '';
95
-
67
+ security.acme.email = "ngi@nixos.org";
68
}