Enable Let's Encrypt for hydra.nixos.org
Eelco Dolstra committed
Apr 7, 2016 at 18:46 UTC
fd14d8e652a89bdd04e92584dde34c53b6bd58c4
1 file changed
+31
-5
delft/hydra-proxy.nix
+31
-5
@@ -16,6 +16,7 @@ let
16
ProxyRequests Off
17
ProxyPreserveHost On
18
ProxyPass /apache-errors !
19
+ ProxyPass /.well-known !
20
ErrorDocument 503 /apache-errors/503.html
21
ProxyPass / http://localhost:3000/ retry=5 disablereuse=on
22
ProxyPassReverse / http://localhost:3000/
@@ -36,6 +37,9 @@ let
37
</Location>
38
'';
39
40
+ acmeKeyDir = "/var/lib/acme/hydra.nixos.org";
41
+ acmeWebRoot = "/var/lib/httpd/acme";
42
+
43
in
44
45
{
@@ -51,17 +55,17 @@ in
55
[ { urlPath = "/apache-errors";
56
dir = ./apache-errors;
57
}
58
+ { urlPath = "/.well-known/acme-challenge";
59
+ dir = "${acmeWebRoot}/.well-known/acme-challenge";
60
+ }
61
];
62
63
virtualHosts = [
64
{ hostName = "hydra.nixos.org";
65
enableSSL = true;
59
- sslServerCert = "/root/ssl-secrets/ssl-nixos.org.crt";
60
- sslServerKey = "/root/ssl-secrets/ssl-nixos.org.key";
66
+ sslServerKey = "${acmeKeyDir}/key.pem";
67
+ sslServerCert = "${acmeKeyDir}/fullchain.pem";
68
extraConfig = ''
62
- SSLCertificateChainFile /root/ssl-secrets/startssl-class1.pem
63
- SSLCACertificateFile /root/ssl-secrets/startssl-ca.pem
64
-
69
# Required by Catalyst.
70
RequestHeader set X-Forwarded-Proto https
71
RequestHeader set X-Forwarded-Port 443
@@ -85,4 +89,26 @@ in
89
startAt = "Sat 05:45";
90
};
91
92
+ # Let's Encrypt configuration.
93
+ security.acme.certs."hydra.nixos.org" =
94
+ { email = "edolstra@gmail.com";
95
+ webroot = acmeWebRoot;
96
+ postRun = "systemctl reload httpd.service";
97
+ };
98
+
99
+ # Generate a dummy self-signed certificate until we get one from
100
+ # Let's Encrypt.
101
+ system.activationScripts.createDummyKey =
102
+ ''
103
+ dir=${acmeKeyDir}
104
+ mkdir -m 0700 -p $dir
105
+ if ! [[ -e $dir/key.pem ]]; then
106
+ ${pkgs.openssl}/bin/openssl genrsa -passout pass:foo -des3 -out $dir/key-in.pem 1024
107
+ ${pkgs.openssl}/bin/openssl req -passin pass:foo -new -key $dir/key-in.pem -out $dir/key.csr \
108
+ -subj "/C=NL/ST=Denial/L=Springfield/O=Dis/CN=www.example.com"
109
+ ${pkgs.openssl}/bin/openssl rsa -passin pass:foo -in $dir/key-in.pem -out $dir/key.pem
110
+ ${pkgs.openssl}/bin/openssl x509 -req -days 365 -in $dir/key.csr -signkey $dir/key.pem -out $dir/fullchain.pem
111
+ fi
112
+ '';
113
+
114
}