www.nixos.org: serve an SSL certificate
Graham Christensen committed
Sep 18, 2017 at 08:05 UTC
d7f0b7db4c3b4da4a3537b78f9797181188216e2
1 file changed
+28
nixos-org/webserver.nix
+28
@@ -123,6 +123,29 @@ in
123
globalRedirect = "https://nixos.org/";
124
}
125
126
+ { # Catch-all site, SSL
127
+ hostName = "www.nixos.org";
128
+ globalRedirect = "https://nixos.org/";
129
+
130
+ enableSSL = true;
131
+ sslServerKey = "${acmeKeyDir}/www.nixos.org/key.pem";
132
+ sslServerCert = "${acmeKeyDir}/www.nixos.org/fullchain.pem";
133
+ extraConfig = nixosVHostConfig.extraConfig +
134
+ ''
135
+ Header always set Strict-Transport-Security "max-age=15552000"
136
+ SSLProtocol All -SSLv2 -SSLv3
137
+ SSLCipherSuite HIGH:!aNULL:!MD5:!EXP
138
+ SSLHonorCipherOrder on
139
+ #SSLOpenSSLConfCmd DHParameters "${./dhparams.pem}"
140
+ '';
141
+ servedDirs =
142
+ [ { urlPath = "/.well-known/acme-challenge";
143
+ dir = "${acmeWebRoot}/.well-known/acme-challenge";
144
+ }
145
+ ];
146
+
147
+ }
148
+
149
(nixosVHostConfig // {
150
extraConfig = nixosVHostConfig.extraConfig;
151
})
@@ -267,6 +290,11 @@ in
290
webroot = "${acmeWebRoot}";
291
postRun = "systemctl reload httpd.service";
292
};
293
+ "www.nixos.org" =
294
+ { email = "edolstra@gmail.com";
295
+ webroot = "${acmeWebRoot}";
296
+ postRun = "systemctl reload httpd.service";
297
+ };
298
};
299
300
# Generate a dummy self-signed certificate until we get one from