l: add lassulus-blog config, repair ssl for cgit

1 files changed, 91 insertions, 0 deletions

diff --git a/lass/2configs/websites/lassulus.nix b/lass/2configs/websites/lassulus.nix
new file mode 100644
index 00000000..04c19fad
--- /dev/null
+++ b/lass/2configs/websites/lassulus.nix
@@ -0,0 +1,91 @@
+{ config, pkgs, lib, ... }:
+
+with lib;
+let
+  inherit (import <stockholm/krebs/4lib> { config = {}; inherit lib; })
+    genid
+  ;
+
+in {
+  imports = [
+    ../git.nix
+  ];
+
+  security.acme = {
+    certs."lassul.us" = {
+      email = "lass@lassul.us";
+      webroot = "/var/lib/acme/challenges/lassul.us";
+      plugins = [
+        "account_key.json"
+        "key.pem"
+        "fullchain.pem"
+        "full.pem"
+      ];
+      allowKeysForGroup = true;
+      group = "lasscert";
+    };
+    certs."cgit.lassul.us" = {
+      email = "lassulus@gmail.com";
+      webroot = "/var/lib/acme/challenges/cgit.lassul.us";
+      plugins = [
+        "account_key.json"
+        "key.pem"
+        "fullchain.pem"
+      ];
+      group = "nginx";
+      allowKeysForGroup = true;
+    };
+  };
+
+  users.groups.lasscert.members = [
+    "dovecot2"
+    "ejabberd"
+    "exim"
+    "nginx"
+  ];
+
+  krebs.nginx.servers."lassul.us" = {
+    server-names = [ "lassul.us" ];
+    locations = [
+      (nameValuePair "/" ''
+        root /srv/http/lassul.us;
+      '')
+      (nameValuePair "/.well-known/acme-challenge" ''
+        root /var/lib/acme/challenges/lassul.us/;
+      '')
+    ];
+    ssl = {
+      enable = true;
+      certificate = "/var/lib/acme/lassul.us/fullchain.pem";
+      certificate_key = "/var/lib/acme/lassul.us/key.pem";
+    };
+  };
+
+  krebs.nginx.servers.cgit = {
+    server-names = [
+      "cgit.lassul.us"
+    ];
+    locations = [
+      (nameValuePair "/.well-known/acme-challenge" ''
+        root /var/lib/acme/challenges/cgit.lassul.us/;
+      '')
+    ];
+    ssl = {
+      enable = true;
+      certificate = "/var/lib/acme/cgit.lassul.us/fullchain.pem";
+      certificate_key = "/var/lib/acme/cgit.lassul.us/key.pem";
+    };
+  };
+
+  users.users.blog = {
+    uid = genid "blog";
+    description = "lassul.us blog deployment";
+    home = "/srv/http/lassul.us";
+    useDefaultShell = true;
+    createHome = true;
+    openssh.authorizedKeys.keys = [
+      config.krebs.users.lass.pubkey
+    ];
+  };
+}
+