Compare commits
2 commits
5a4a317459
...
3f5c5c8d1b
Author | SHA1 | Date | |
---|---|---|---|
3f5c5c8d1b | |||
15b0781bee |
3 changed files with 72 additions and 3 deletions
25
systems/vesuvio/certificates.nix
Normal file
25
systems/vesuvio/certificates.nix
Normal file
|
@ -0,0 +1,25 @@
|
|||
{ config, ... }:
|
||||
{
|
||||
security.acme = {
|
||||
acceptTerms = true;
|
||||
defaults = {
|
||||
email = "acme@uku.moe";
|
||||
webroot = "/var/lib/acme/acme-challenge";
|
||||
};
|
||||
};
|
||||
|
||||
services.nginx.virtualHosts = {
|
||||
"acme.uku3lig.net" = {
|
||||
serverAliases = [
|
||||
"*.uku3lig.net"
|
||||
"*.uku.moe"
|
||||
];
|
||||
|
||||
locations."/.well-known/acme-challenge".root = config.security.acme.defaults.webroot;
|
||||
};
|
||||
};
|
||||
|
||||
# /var/lib/acme/acme-challenge must be writable by the ACME user and readable by the Nginx user.
|
||||
# The easiest way to achieve this is to add the Nginx user to the ACME group.
|
||||
users.users.nginx.extraGroups = [ "acme" ];
|
||||
}
|
|
@ -1,6 +1,7 @@
|
|||
{ pkgs, ... }:
|
||||
{
|
||||
imports = [
|
||||
./certificates.nix
|
||||
./frp.nix
|
||||
./hetzner.nix
|
||||
];
|
||||
|
@ -10,8 +11,16 @@
|
|||
traceroute
|
||||
];
|
||||
|
||||
services.openssh = {
|
||||
services = {
|
||||
nginx.enable = true;
|
||||
openssh = {
|
||||
ports = [ 4269 ];
|
||||
openFirewall = true;
|
||||
};
|
||||
};
|
||||
|
||||
networking.firewall.allowedTCPPorts = [
|
||||
80
|
||||
443
|
||||
];
|
||||
}
|
||||
|
|
35
systems/vesuvio/mail.nix
Normal file
35
systems/vesuvio/mail.nix
Normal file
|
@ -0,0 +1,35 @@
|
|||
{ config, ... }:
|
||||
let
|
||||
certName = "mail.c.uku3lig.net";
|
||||
certLocation = config.security.acme.certs.${certName}.directory;
|
||||
in
|
||||
{
|
||||
security.acme.certs.${certName} = {
|
||||
group = config.services.maddy.group;
|
||||
extraLegoRenewFlags = [ "--reuse-key" ]; # soopyc said its more secure
|
||||
};
|
||||
|
||||
services.maddy = {
|
||||
enable = true;
|
||||
hostname = "mx1.uku3lig.net";
|
||||
primaryDomain = "uku3lig.net";
|
||||
localDomains = [
|
||||
"$(primary_domain)"
|
||||
"uku.moe"
|
||||
];
|
||||
|
||||
tls = {
|
||||
loader = "file";
|
||||
certificates = [
|
||||
{
|
||||
certPath = "${certLocation}/fullchain.pem";
|
||||
keyPath = "${certLocation}/key.pem";
|
||||
}
|
||||
];
|
||||
};
|
||||
|
||||
config = ''
|
||||
|
||||
'';
|
||||
};
|
||||
}
|
Loading…
Add table
Add a link
Reference in a new issue