flake.lock

@@ -165,11 +165,11 @@
     },
     "secrets": {
       "locked": {
-        "lastModified": 1713917034,
-        "narHash": "sha256-TcRTcrx6Y+qZpoOvCu+DNyHWGFOFxL4bDMCD2EvYNsg=",
+        "lastModified": 1713906026,
+        "narHash": "sha256-pI2SocGL1Ev54UXizRL2L6t3UmBFVGGmcSgBmthSeJU=",
         "ref": "refs/heads/master",
-        "rev": "d73392f1e37da591bbc2700a37beba60c5bc4648",
-        "revCount": 25,
+        "rev": "84f9be99ee397303cb23dfc8713115088fa7a53d",
+        "revCount": 23,
         "type": "git",
         "url": "ssh://git@git.caspervk.net/caspervk/nixos-secrets.git"
       },

hosts/alpha/acme.nix

@@ -1,16 +1,14 @@
 {lib, ...}: {
-  security.acme.certs = {
-    "caspervk.net" = {
-      domain = "*.caspervk.net";
-      reloadServices = [
-        "caddy.service"
-        "murmur.service"
-      ];
-      # The NixOS Caddy module is a little too clever and sets the cert's group
-      # to 'caddy', which means other services can't load it. This is not needed
-      # since we handle the group membership manually.
-      group = lib.mkForce "acme";
-    };
+  security.acme.certs."caspervk.net" = {
+    domain = "*.caspervk.net";
+    reloadServices = [
+      "caddy.service"
+      "murmur.service"
+    ];
+    # The NixOS Caddy module is a little too clever and sets the cert's group
+    # to 'caddy', which means other services can't load it. This is not needed
+    # since we handle the group membership manually.
+    group = lib.mkForce "acme";
   };
   users.groups.acme.members = [
     "caddy"

hosts/delta/acme.nix

@@ -1,12 +1,10 @@
 {...}: {
-  security.acme.certs = {
-    "caspervk.net" = {
-      domain = "*.caspervk.net";
-      reloadServices = [
-        "kresd@1.service"
-        "kresd@2.service"
-      ];
-    };
+  security.acme.certs."caspervk.net" = {
+    domain = "*.caspervk.net";
+    reloadServices = [
+      "kresd@1.service"
+      "kresd@2.service"
+    ];
   };
   users.groups.acme.members = [
     "knot-resolver"

hosts/sigma/acme.nix

@@ -1,21 +1,13 @@
 {lib, ...}: {
-  security.acme.certs = {
-    "caspervk.net" = {
-      domain = "*.caspervk.net";
-      reloadServices = [
-        "caddy.service"
-      ];
-      # The NixOS Caddy module is a little too clever and sets the cert's group
-      # to 'caddy', which means other services can't load it. This is not needed
-      # since we handle the group membership manually.
-      group = lib.mkForce "acme";
-    };
-    "sudomail.org" = {
-      reloadServices = [
-        "caddy.service"
-      ];
-      group = lib.mkForce "acme";
-    };
+  security.acme.certs."caspervk.net" = {
+    domain = "*.caspervk.net";
+    reloadServices = [
+      "caddy.service"
+    ];
+    # The NixOS Caddy module is a little too clever and sets the cert's group
+    # to 'caddy', which means other services can't load it. This is not needed
+    # since we handle the group membership manually.
+    group = lib.mkForce "acme";
   };
   users.groups.acme.members = [
     "caddy"

modules/server/caddy.nix

@@ -20,7 +20,7 @@ lib.mkIf (config.services.caddy.virtualHosts != {}) {
   environment.persistence."/nix/persist" = {
     directories = [
       {
-        directory = "/var/www/html";
+        directory = "/var/lib/caddy";
         user = "caddy";
         group = "caddy";
         mode = "0755";