turn on tls for netboot
Graham Christensen committed
Sep 29, 2022 at 20:18 UTC
da64bed10cd666e61697efca84a75ea4d0854ea3
1 file changed
+25
-2
delft/eris.nix
+25
-2
@@ -40,6 +40,29 @@ in
40
listen = "127.0.0.1:3000";
41
};
42
43
+ security.acme = {
44
+ # these cert parameters are very specifically & carefully chosen for iPXE compatibility.
45
+ certs."netboot.nixos.org" = {
46
+ keyType = "rsa4096";
47
+ extraLegoRunFlags = [
48
+ # re: https://community.letsencrypt.org/t/production-chain-changes/150739/1
49
+ # re: https://github.com/ipxe/ipxe/pull/116
50
+ # re: https://github.com/ipxe/ipxe/pull/112
51
+ # re: https://lists.ipxe.org/pipermail/ipxe-devel/2020-May/007042.html
52
+ "--preferred-chain"
53
+ "ISRG Root X1"
54
+ ];
55
+ extraLegoRenewFlags = [
56
+ # re: https://community.letsencrypt.org/t/production-chain-changes/150739/1
57
+ # re: https://github.com/ipxe/ipxe/pull/116
58
+ # re: https://github.com/ipxe/ipxe/pull/112
59
+ # re: https://lists.ipxe.org/pipermail/ipxe-devel/2020-May/007042.html
60
+ "--preferred-chain"
61
+ "ISRG Root X1"
62
+ ];
63
+ };
64
+ };
65
+
66
services.nginx = {
67
enable = true;
68
recommendedProxySettings = true;
@@ -48,8 +71,8 @@ in
71
sslCiphers = options.services.nginx.sslCiphers.default + ":AES256-SHA256"; # iPXE needs AES256-SHA256
72
73
virtualHosts."netboot.nixos.org" = {
51
- enableACME = false;
52
- forceSSL = false;
74
+ enableACME = true;
75
+ forceSSL = true;
76
locations."/".proxyPass = "http://127.0.0.1:3000/";
77
};
78