caspervk/nixos
1
0
Fork 0
Code Actions Activity

caddy files

Browse source
This commit is contained in:
Casper V. Kristensen 2024-04-24 02:06:04 +02:00
parent 8bce4b0326
commit 931bce3d9f
4 changed files with 38 additions and 26 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

22
hosts/alpha/acme.nix
View file

@ -1,14 +1,16 @@
{lib, ...}: { {lib, ...}: {
security.acme.certs."caspervk.net" = { security.acme.certs = {
domain = "*.caspervk.net"; "caspervk.net" = {
reloadServices = [ domain = "*.caspervk.net";
"caddy.service" reloadServices = [
"murmur.service" "caddy.service"
]; "murmur.service"
# The NixOS Caddy module is a little too clever and sets the cert's group ];
# to 'caddy', which means other services can't load it. This is not needed # The NixOS Caddy module is a little too clever and sets the cert's group
# since we handle the group membership manually. # to 'caddy', which means other services can't load it. This is not needed
group = lib.mkForce "acme"; # since we handle the group membership manually.
group = lib.mkForce "acme";
};
}; };
users.groups.acme.members = [ users.groups.acme.members = [
"caddy" "caddy"

14
hosts/delta/acme.nix
View file

@ -1,10 +1,12 @@
{...}: { {...}: {
security.acme.certs."caspervk.net" = { security.acme.certs = {
domain = "*.caspervk.net"; "caspervk.net" = {
reloadServices = [ domain = "*.caspervk.net";
"kresd@1.service" reloadServices = [
"kresd@2.service" "kresd@1.service"
]; "kresd@2.service"
];
};
}; };
users.groups.acme.members = [ users.groups.acme.members = [
"knot-resolver" "knot-resolver"

26
hosts/sigma/acme.nix
View file

@ -1,13 +1,21 @@
{lib, ...}: { {lib, ...}: {
security.acme.certs."caspervk.net" = { security.acme.certs = {
domain = "*.caspervk.net"; "caspervk.net" = {
reloadServices = [ domain = "*.caspervk.net";
"caddy.service" reloadServices = [
]; "caddy.service"
# The NixOS Caddy module is a little too clever and sets the cert's group ];
# to 'caddy', which means other services can't load it. This is not needed # The NixOS Caddy module is a little too clever and sets the cert's group
# since we handle the group membership manually. # to 'caddy', which means other services can't load it. This is not needed
group = lib.mkForce "acme"; # since we handle the group membership manually.
group = lib.mkForce "acme";
};
"sudomail.org" = {
reloadServices = [
"caddy.service"
];
group = lib.mkForce "acme";
};
}; };
users.groups.acme.members = [ users.groups.acme.members = [
"caddy" "caddy"

2
modules/server/caddy.nix
View file

@ -20,7 +20,7 @@ lib.mkIf (config.services.caddy.virtualHosts != {}) {
environment.persistence."/nix/persist" = { environment.persistence."/nix/persist" = {
directories = [ directories = [
{ {
directory = "/var/lib/caddy"; directory = "/var/www/html";
user = "caddy"; user = "caddy";
group = "caddy"; group = "caddy";
mode = "0755"; mode = "0755";