92 lines
1.9 KiB
Nix
92 lines
1.9 KiB
Nix
|
{ config, pkgs, lib, ... }:
|
||
|
|
|
||
|
|
with lib;
|
||
|
|
let
|
||
|
|
inherit (import <stockholm/krebs/4lib> { config = {}; inherit lib; })
|
||
|
|
genid
|
||
|
|
;
|
||
|
|
|
||
|
|
in {
|
||
|
|
imports = [
|
||
|
|
../git.nix
|
||
|
|
];
|
||
|
|
|
||
|
|
security.acme = {
|
||
|
|
certs."lassul.us" = {
|
||
|
|
email = "lass@lassul.us";
|
||
|
|
webroot = "/var/lib/acme/challenges/lassul.us";
|
||
|
|
plugins = [
|
||
|
|
"account_key.json"
|
||
|
|
"key.pem"
|
||
|
|
"fullchain.pem"
|
||
|
|
"full.pem"
|
||
|
|
];
|
||
|
|
allowKeysForGroup = true;
|
||
|
|
group = "lasscert";
|
||
|
|
};
|
||
|
|
certs."cgit.lassul.us" = {
|
||
|
|
email = "lassulus@gmail.com";
|
||
|
|
webroot = "/var/lib/acme/challenges/cgit.lassul.us";
|
||
|
|
plugins = [
|
||
|
|
"account_key.json"
|
||
|
|
"key.pem"
|
||
|
|
"fullchain.pem"
|
||
|
|
];
|
||
|
|
group = "nginx";
|
||
|
|
allowKeysForGroup = true;
|
||
|
|
};
|
||
|
|
};
|
||
|
|
|
||
|
|
users.groups.lasscert.members = [
|
||
|
|
"dovecot2"
|
||
|
|
"ejabberd"
|
||
|
|
"exim"
|
||
|
|
"nginx"
|
||
|
|
];
|
||
|
|
|
||
|
|
krebs.nginx.servers."lassul.us" = {
|
||
|
|
server-names = [ "lassul.us" ];
|
||
|
|
locations = [
|
||
|
|
(nameValuePair "/" ''
|
||
|
|
root /srv/http/lassul.us;
|
||
|
|
'')
|
||
|
|
(nameValuePair "/.well-known/acme-challenge" ''
|
||
|
|
root /var/lib/acme/challenges/lassul.us/;
|
||
|
|
'')
|
||
|
|
];
|
||
|
|
ssl = {
|
||
|
|
enable = true;
|
||
|
|
certificate = "/var/lib/acme/lassul.us/fullchain.pem";
|
||
|
|
certificate_key = "/var/lib/acme/lassul.us/key.pem";
|
||
|
|
};
|
||
|
|
};
|
||
|
|
|
||
|
|
krebs.nginx.servers.cgit = {
|
||
|
|
server-names = [
|
||
|
|
"cgit.lassul.us"
|
||
|
|
];
|
||
|
|
locations = [
|
||
|
|
(nameValuePair "/.well-known/acme-challenge" ''
|
||
|
|
root /var/lib/acme/challenges/cgit.lassul.us/;
|
||
|
|
'')
|
||
|
|
];
|
||
|
|
ssl = {
|
||
|
|
enable = true;
|
||
|
|
certificate = "/var/lib/acme/cgit.lassul.us/fullchain.pem";
|
||
|
|
certificate_key = "/var/lib/acme/cgit.lassul.us/key.pem";
|
||
|
|
};
|
||
|
|
};
|
||
|
|
|
||
|
|
users.users.blog = {
|
||
|
|
uid = genid "blog";
|
||
|
|
description = "lassul.us blog deployment";
|
||
|
|
home = "/srv/http/lassul.us";
|
||
|
|
useDefaultShell = true;
|
||
|
|
createHome = true;
|
||
|
|
openssh.authorizedKeys.keys = [
|
||
|
|
config.krebs.users.lass.pubkey
|
||
|
|
];
|
||
|
|
};
|
||
|
|
}
|
||
|
|
|