planet.nixos.org: setup an SSL cert
Graham Christensen committed
Aug 30, 2017 at 16:33 UTC
dc8e162f174201080d713de3b908ec15c5c24750
1 file changed
+36
-5
nixos-org/webserver.nix
+36
-5
@@ -160,6 +160,28 @@ in
160
161
{ hostName = "planet.nixos.org";
162
documentRoot = "/var/www/planet.nixos.org";
163
+ enableSSL = true;
164
+ sslServerKey = "${acmeKeyDir}/planet.nixos.org/key.pem";
165
+ sslServerCert = "${acmeKeyDir}/planet.nixos.org/fullchain.pem";
166
+ extraConfig = nixosVHostConfig.extraConfig +
167
+ ''
168
+ Header always set Strict-Transport-Security "max-age=15552000"
169
+ SSLProtocol All -SSLv2 -SSLv3
170
+ SSLCipherSuite HIGH:!aNULL:!MD5:!EXP
171
+ SSLHonorCipherOrder on
172
+ #SSLOpenSSLConfCmd DHParameters "${./dhparams.pem}"
173
+
174
+ # Rewrite HTTP to HTTPS
175
+ RewriteCond %{HTTPS} off
176
+ RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI} [R=301,L]
177
+
178
+ '';
179
+
180
+ servedDirs =
181
+ [ { urlPath = "/.well-known/acme-challenge";
182
+ dir = "${acmeWebRoot}/planet.nixos.org/.well-known/acme-challenge";
183
+ }
184
+ ];
185
}
186
];
187
};
@@ -230,11 +252,19 @@ in
252
nix.gc.automatic = true;
253
254
# Let's Encrypt configuration.
233
- security.acme.certs."nixos.org" =
234
- { email = "edolstra@gmail.com";
235
- webroot = "${acmeWebRoot}/nixos.org";
236
- postRun = "systemctl reload httpd.service";
237
- };
255
+ security.acme.certs = {
256
+ "nixos.org" =
257
+ { email = "edolstra@gmail.com";
258
+ webroot = "${acmeWebRoot}/nixos.org";
259
+ postRun = "systemctl reload httpd.service";
260
+ };
261
+ "planet.nixos.org" =
262
+ { email = "edolstra@gmail.com";
263
+ webroot = "${acmeWebRoot}/planet.nixos.org";
264
+ postRun = "systemctl reload httpd.service";
265
+ };
266
+ };
267
+
268
269
# Generate a dummy self-signed certificate until we get one from
270
# Let's Encrypt.
@@ -256,6 +286,7 @@ in
286
in
287
''
288
${mkKeys "${acmeKeyDir}/nixos.org"}
289
+ ${mkKeys "${acmeKeyDir}/planet.nixos.org"}
290
'';
291
292
}