nixos.org: parameterize acme for multiple domains
Graham Christensen committed
Aug 30, 2017 at 08:18 UTC
f9b7035c062195d1140e163f5f015cc33305570f
1 file changed
+19
-12
nixos-org/webserver.nix
+19
-12
@@ -6,7 +6,7 @@ let
6
7
sshKeys = import ../ssh-keys.nix;
8
9
- acmeKeyDir = "/var/lib/acme/nixos.org";
9
+ acmeKeyDir = "/var/lib/acme/";
10
acmeWebRoot = "/var/lib/httpd/acme";
11
12
nixosVHostConfig =
@@ -129,8 +129,8 @@ in
129
130
(nixosVHostConfig // {
131
enableSSL = true;
132
- sslServerKey = "${acmeKeyDir}/key.pem";
133
- sslServerCert = "${acmeKeyDir}/fullchain.pem";
132
+ sslServerKey = "${acmeKeyDir}/nixos.org/key.pem";
133
+ sslServerCert = "${acmeKeyDir}/nixos.org/fullchain.pem";
134
extraConfig = nixosVHostConfig.extraConfig +
135
''
136
Header always set Strict-Transport-Security "max-age=15552000"
@@ -239,16 +239,23 @@ in
239
# Generate a dummy self-signed certificate until we get one from
240
# Let's Encrypt.
241
system.activationScripts.createDummyKey =
242
+ let
243
+ mkKeys = dir:
244
+ ''
245
+ dir=${dir}
246
+ mkdir -m 0700 -p $dir
247
+ if ! [[ -e $dir/key.pem ]]; then
248
+ ${pkgs.openssl}/bin/openssl genrsa -passout pass:foo -des3 -out $dir/key-in.pem 1024
249
+ ${pkgs.openssl}/bin/openssl req -passin pass:foo -new -key $dir/key-in.pem -out $dir/key.csr \
250
+ -subj "/C=NL/ST=Denial/L=Springfield/O=Dis/CN=www.example.com"
251
+ ${pkgs.openssl}/bin/openssl rsa -passin pass:foo -in $dir/key-in.pem -out $dir/key.pem
252
+ ${pkgs.openssl}/bin/openssl x509 -req -days 365 -in $dir/key.csr -signkey $dir/key.pem -out $dir/fullchain.pem
253
+ fi
254
+ '';
255
+
256
+ in
257
''
243
- dir=${acmeKeyDir}
244
- mkdir -m 0700 -p $dir
245
- if ! [[ -e $dir/key.pem ]]; then
246
- ${pkgs.openssl}/bin/openssl genrsa -passout pass:foo -des3 -out $dir/key-in.pem 1024
247
- ${pkgs.openssl}/bin/openssl req -passin pass:foo -new -key $dir/key-in.pem -out $dir/key.csr \
248
- -subj "/C=NL/ST=Denial/L=Springfield/O=Dis/CN=www.example.com"
249
- ${pkgs.openssl}/bin/openssl rsa -passin pass:foo -in $dir/key-in.pem -out $dir/key.pem
250
- ${pkgs.openssl}/bin/openssl x509 -req -days 365 -in $dir/key.csr -signkey $dir/key.pem -out $dir/fullchain.pem
251
- fi
258
+ ${mkKeys "${acmeKeyDir}/nixos.org"}
259
'';
260
261
}