Kaare Hoff Skovgaard
c402ada8f7
This should enable DNS-01 acme for all khs openstack servers, thus removing the pain of setting up acme for those servers. Do note that this might not really be needed that much anymore, as I should be able to hit them over IPv6, but for ease of mind, this will enable ACME trivially, also for non https workloads, as well as servers without open ports. Do note that currently there's a global unifi firewall rule in place to allow port 80 and 443 to my own servers over ipv6, I'd like to remove this and have Nix configure firewall rules for each server individually, as requested in the setup.
59 lines
1.9 KiB
Nix
59 lines
1.9 KiB
Nix
{ config, lib, ... }:
|
|
let
|
|
cfg = config.khscodes.security.acme;
|
|
vaultAgentCredentialsFile = "/var/lib/vault-agent/acme/cloudflare-api-token";
|
|
cloudflareSecret = "opentofu/data/cloudflare";
|
|
acmeServicesToRestart = lib.lists.map (a: "acme-${a}.service") (
|
|
lib.attrsets.attrNames config.security.acme.certs
|
|
);
|
|
in
|
|
{
|
|
options.khscodes.security.acme = {
|
|
enable = lib.mkEnableOption "Enables acme";
|
|
dns01Enabled = lib.mkOption {
|
|
type = lib.types.bool;
|
|
description = "Whether to use DNS01 instead of http-01 challenges. This will make the approle gain policy to retrieve the needed cloudflare secrets to manage dns.";
|
|
default = config.khscodes.infrastructure.khs-openstack-instance.enable;
|
|
};
|
|
};
|
|
config = lib.mkIf cfg.enable {
|
|
security.acme = {
|
|
acceptTerms = true;
|
|
defaults =
|
|
{
|
|
email = "kaare@kaareskovgaard.net";
|
|
}
|
|
// lib.attrsets.optionalAttrs cfg.dns01Enabled {
|
|
dnsProvider = "cloudflare";
|
|
dnsResolver = null;
|
|
credentialsFile = vaultAgentCredentialsFile;
|
|
};
|
|
};
|
|
khscodes.infrastructure.vault-server-approle = {
|
|
enable = true;
|
|
policy = {
|
|
"${cloudflareSecret}" = {
|
|
capabilities = [ "read" ];
|
|
};
|
|
};
|
|
};
|
|
khscodes.services.vault-agent = lib.mkIf (cfg.dns01Enabled && acmeServicesToRestart != [ ]) {
|
|
enable = true;
|
|
templates = [
|
|
{
|
|
contents = ''
|
|
{{- with secret "${cloudflareSecret}" -}}
|
|
CLOUDFLARE_DNS_API_TOKEN={{ .Data.data.TF_VAR_cloudflare_token }}
|
|
CLOUDFLARE_DNS_EMAIL={{ .Data.data.TF_VAR_cloudflare_email }}
|
|
{{- end -}}
|
|
'';
|
|
destination = vaultAgentCredentialsFile;
|
|
perms = "0600";
|
|
owner = "acme";
|
|
group = "acme";
|
|
restartUnits = acmeServicesToRestart;
|
|
}
|
|
];
|
|
};
|
|
};
|
|
}
|