blob: 411234b8296ad7f8c19fe58e93a6bff66f251cad (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
|
{ config, pkgs, lib, ... }:
with lib;
let
inherit (import <stockholm/lib>)
genid_uint31
;
in {
imports = [
./default.nix
../git.nix
./ref.ptkk.de
];
security.acme = {
email = "acme@lassul.us";
acceptTerms = true;
certs."lassul.us" = {
group = "lasscert";
};
};
users.groups.lasscert.members = [
"dovecot2"
"exim"
"nginx"
];
services.nginx.virtualHosts."lassul.us" = {
addSSL = true;
enableACME = true;
default = true;
locations."/".extraConfig = ''
root /srv/http/lassul.us;
'';
locations."= /retiolum-hosts.tar.bz2".extraConfig = ''
alias ${config.krebs.tinc.retiolum.hostsArchive};
'';
locations."= /hosts".extraConfig = ''
alias ${pkgs.krebs-hosts_combined};
'';
locations."= /retiolum.hosts".extraConfig = ''
alias ${pkgs.krebs-hosts-retiolum};
'';
locations."= /wireguard-key".extraConfig = ''
alias ${pkgs.writeText "prism.wg" config.krebs.hosts.prism.nets.wiregrill.wireguard.pubkey};
'';
locations."= /krebspage".extraConfig = ''
default_type "text/html";
alias ${pkgs.krebspage}/index.html;
'';
locations."= /init".extraConfig = let
initscript = pkgs.init.override {
pubkey = config.krebs.users.lass.pubkey;
};
in ''
alias ${initscript}/bin/init;
'';
locations."= /blue.pub".extraConfig = ''
alias ${pkgs.writeText "pub" config.krebs.users.lass-blue.pubkey};
'';
locations."= /ssh.pub".extraConfig = ''
alias ${pkgs.writeText "pub" config.krebs.users.lass-yubikey.pubkey};
'';
locations."= /gpg.pub".extraConfig = ''
alias ${pkgs.writeText "pub" config.krebs.users.lass-yubikey.pgp.pubkeys.default};
'';
};
security.acme.certs."cgit.lassul.us" = {
email = "lassulus@lassul.us";
webroot = "/var/lib/acme/acme-challenge";
group = "nginx";
};
services.nginx.virtualHosts.cgit = {
serverName = "cgit.lassul.us";
addSSL = true;
sslCertificate = "/var/lib/acme/cgit.lassul.us/fullchain.pem";
sslCertificateKey = "/var/lib/acme/cgit.lassul.us/key.pem";
locations."/.well-known/acme-challenge".extraConfig = ''
root /var/lib/acme/acme-challenge;
'';
};
}
|
