alejandro-angulo/dotfiles
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Refactored how SSL certs are configured for nginx

Browse source 
Made a separate ACME module to handle requesting certs from multiple
machines. Right now, the module only supports exactly one wildcard cert.
It might make sense to have cache.kilonull.com use a cert specific to
its subdomain rather than also requesting a wildcard cert (or maybe the
nginx on its host shouldn't care about TLS and it should be node's
responsibility).
This commit is contained in:
Alejandro Angulo 2023-07-16 10:53:02 -07:00
parent 60917107b1
commit d5969ca923
Signed by: alejandro-angulo
GPG key ID: 75579581C74554B6
9 changed files with 128 additions and 41 deletions
Download patch file Download diff file Expand all files Collapse all files

12
modules/services/nextcloud/default.nix
View file

@ -11,6 +11,14 @@ with lib; let
in {
options.aa.services.nextcloud = with types; {
enable = mkEnableOption "nextcloud";
acmeCertName = mkOption {
type = str;
default = "";
description = ''
If set to a non-empty string, forces SSL with the supplied acme
certificate.
'';
};
};
config = mkIf cfg.enable {
@ -47,9 +55,9 @@ in {
};
# nextcloud module configures nginx, just need to specify SSL stuffs here
services.nginx.virtualHosts.${config.services.nextcloud.hostName} = {
services.nginx.virtualHosts.${config.services.nextcloud.hostName} = mkIf (cfg.acmeCertName != "") {
forceSSL = true;
useACMEHost = "kilonull.com";
useACMEHost = cfg.acmeCertName;
};
networking.firewall.allowedTCPPorts = [80 443];