Add a filesWatcher service to restart them when secrets change

[perso/Immae/Config/Nix.git] / modules / websites / default.nix

diff --git a/modules/websites/default.nix b/modules/websites/default.nix
index b76aeead489cea4b2810c9f2537637489c835506..4b21efb75eb386e97a42068313080d132e29cf05 100644 (file)
--- a/modules/websites/default.nix
+++ b/modules/websites/default.nix
@@ -91,6 +91,13 @@ in
             };
           });
         };
+        watchPaths = mkOption {
+          type = listOf string;
+          default = [];
+          description = ''
+            Paths to watch that should trigger a reload of httpd
+            '';
+        };
       };
     });
   };
@@ -102,7 +109,7 @@ in
       serverAliases = [ "*" ];
       enableSSL = false;
       logFormat = "combinedVhost";
-      documentRoot = "/var/lib/acme/acme-challenge";
+      documentRoot = "${config.security.acme.directory}/acme-challenge";
       extraConfig = ''
         RewriteEngine on
         RewriteCond "%{REQUEST_URI}"   "!^/\.well-known"
@@ -131,9 +138,9 @@ in
     };
     toVhost = ips: vhostConf: {
       enableSSL = true;
-      sslServerCert = "/var/lib/acme/${vhostConf.certName}/cert.pem";
-      sslServerKey = "/var/lib/acme/${vhostConf.certName}/key.pem";
-      sslServerChain = "/var/lib/acme/${vhostConf.certName}/chain.pem";
+      sslServerCert = "${config.security.acme.directory}/${vhostConf.certName}/cert.pem";
+      sslServerKey = "${config.security.acme.directory}/${vhostConf.certName}/key.pem";
+      sslServerChain = "${config.security.acme.directory}/${vhostConf.certName}/chain.pem";
       logFormat = "combinedVhost";
       listen = map (ip: { inherit ip; port = 443; }) ips;
       hostName = builtins.head vhostConf.hosts;
@@ -159,6 +166,13 @@ in
     })
   ) cfg;
 
+  config.services.filesWatcher = attrsets.mapAttrs' (name: icfg: attrsets.nameValuePair
+    "httpd${icfg.httpdName}" {
+      paths = icfg.watchPaths;
+      waitTime = 5;
+    }
+  ) cfg;
+
   config.security.acme.certs = let
     typesToManage = attrsets.filterAttrs (k: v: v.enable) cfg;
     flatVhosts = lists.flatten (attrsets.mapAttrsToList (k: v: