mdebray/tvl-depot
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat(ops/nixos/camden): Move ACME configuration out of nginx

Browse source 
This makes it possible to re-use the same provisioning mechanism for
multiple related domains.
This commit is contained in:
Vincent Ambo 2020-02-12 01:08:27 +00:00
parent 8e52e74bd3
commit 7373edf73a
1 changed files with 13 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

17
ops/nixos/camden/default.nix
View file

@ -143,14 +143,23 @@ in pkgs.lib.fix(self: {
};
};
# Provision a TLS certificate outside of nginx to avoid
# nixpkgs#38144
security.acme.certs."camden.tazj.in" = {
user = "nginx";
group = "nginx";
webroot = "/var/lib/acme/acme-challenge";
postRun = "systemctl reload nginx";
};
# serve my website
services.nginx = {
enable = true;
enableReload = true;
# recommendedTlsSettings = true;
# recommendedGzipSettings = true;
# recommendedProxySettings = true;
recommendedTlsSettings = true;
recommendedGzipSettings = true;
recommendedProxySettings = true;
commonHttpConfig = ''
log_format json_combined escape=json
@ -172,7 +181,7 @@ in pkgs.lib.fix(self: {
virtualHosts.homepage = {
serverName = "camden.tazj.in"; # TODO(tazjin): change to actual host later
default = true;
enableACME = true;
useACMEHost = "camden.tazj.in";
root = pkgs.web.homepage;
addSSL = true;