caspervk/nixos
1
0
Fork 0
Code Actions Activity

caddy files

Browse source
This commit is contained in:
Casper V. Kristensen 2024-04-24 02:06:04 +02:00
parent 8bce4b0326
commit 931bce3d9f
4 changed files with 38 additions and 26 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

22
hosts/alpha/acme.nix
View file

@ -1,14 +1,16 @@
{lib, ...}: {
security.acme.certs."caspervk.net" = {
domain = "*.caspervk.net";
reloadServices = [
"caddy.service"
"murmur.service"
];
# The NixOS Caddy module is a little too clever and sets the cert's group
# to 'caddy', which means other services can't load it. This is not needed
# since we handle the group membership manually.
group = lib.mkForce "acme";
security.acme.certs = {
"caspervk.net" = {
domain = "*.caspervk.net";
reloadServices = [
"caddy.service"
"murmur.service"
];
# The NixOS Caddy module is a little too clever and sets the cert's group
# to 'caddy', which means other services can't load it. This is not needed
# since we handle the group membership manually.
group = lib.mkForce "acme";
};
};
users.groups.acme.members = [
"caddy"

14
hosts/delta/acme.nix
View file

@ -1,10 +1,12 @@
{...}: {
security.acme.certs."caspervk.net" = {
domain = "*.caspervk.net";
reloadServices = [
"kresd@1.service"
"kresd@2.service"
];
security.acme.certs = {
"caspervk.net" = {
domain = "*.caspervk.net";
reloadServices = [
"kresd@1.service"
"kresd@2.service"
];
};
};
users.groups.acme.members = [
"knot-resolver"

26
hosts/sigma/acme.nix
View file

@ -1,13 +1,21 @@
{lib, ...}: {
security.acme.certs."caspervk.net" = {
domain = "*.caspervk.net";
reloadServices = [
"caddy.service"
];
# The NixOS Caddy module is a little too clever and sets the cert's group
# to 'caddy', which means other services can't load it. This is not needed
# since we handle the group membership manually.
group = lib.mkForce "acme";
security.acme.certs = {
"caspervk.net" = {
domain = "*.caspervk.net";
reloadServices = [
"caddy.service"
];
# The NixOS Caddy module is a little too clever and sets the cert's group
# to 'caddy', which means other services can't load it. This is not needed
# since we handle the group membership manually.
group = lib.mkForce "acme";
};
"sudomail.org" = {
reloadServices = [
"caddy.service"
];
group = lib.mkForce "acme";
};
};
users.groups.acme.members = [
"caddy"

2
modules/server/caddy.nix
View file

@ -20,7 +20,7 @@ lib.mkIf (config.services.caddy.virtualHosts != {}) {
environment.persistence."/nix/persist" = {
directories = [
{
directory = "/var/lib/caddy";
directory = "/var/www/html";
user = "caddy";
group = "caddy";
mode = "0755";