X-Git-Url: https://git.immae.eu/?a=blobdiff_plain;f=modules%2Fprivate%2Fcertificates.nix;h=c564d34f17832d784875ef60ea0950b9e23a4198;hb=3c50eea8d946bf8417f49fa8a4a6e109e0439c7b;hp=c68bbee5f585d4bdf69376a687180c9cf9e92e78;hpb=3ffa15baf832f5b94cfd8d1b978eaa42f4102e07;p=perso%2FImmae%2FConfig%2FNix.git

diff --git a/modules/private/certificates.nix b/modules/private/certificates.nix
index c68bbee..c564d34 100644
--- a/modules/private/certificates.nix
+++ b/modules/private/certificates.nix
@@ -45,19 +45,22 @@
     };
 
     systemd.services = lib.attrsets.mapAttrs' (k: v:
-      lib.attrsets.nameValuePair "acme-selfsigned-${k}" { script = lib.mkBefore ''
-        cp $workdir/server.crt ${config.security.acme.certs."${k}".directory}/cert.pem
-        chown '${v.user}:${v.group}' ${config.security.acme.certs."${k}".directory}/cert.pem
-        chmod ${if v.allowKeysForGroup then "750" else "700"} ${config.security.acme.certs."${k}".directory}/cert.pem
+      lib.attrsets.nameValuePair "acme-selfsigned-${k}" {
+          wantedBy = [ "acme-selfsigned-certificates.target" ];
+          script = lib.mkAfter ''
+          cp $workdir/server.crt ${config.security.acme.certs."${k}".directory}/cert.pem
+          chown '${v.user}:${v.group}' ${config.security.acme.certs."${k}".directory}/cert.pem
+          chmod ${if v.allowKeysForGroup then "750" else "700"} ${config.security.acme.certs."${k}".directory}/cert.pem
 
-        cp $workdir/ca.crt ${config.security.acme.certs."${k}".directory}/chain.pem
-        chown '${v.user}:${v.group}' ${config.security.acme.certs."${k}".directory}/chain.pem
-        chmod ${if v.allowKeysForGroup then "750" else "700"} ${config.security.acme.certs."${k}".directory}/chain.pem
-        '';
-      }
-    ) config.security.acme.certs //
+          cp $workdir/ca.crt ${config.security.acme.certs."${k}".directory}/chain.pem
+          chown '${v.user}:${v.group}' ${config.security.acme.certs."${k}".directory}/chain.pem
+          chmod ${if v.allowKeysForGroup then "750" else "700"} ${config.security.acme.certs."${k}".directory}/chain.pem
+          '';
+        }
+      ) config.security.acme.certs //
     lib.attrsets.mapAttrs' (k: data:
       lib.attrsets.nameValuePair "acme-${k}" {
+        after = lib.mkAfter [ "bind.service" ];
         serviceConfig.ExecStartPre =
           let
             script = pkgs.writeScript "acme-pre-start" ''
@@ -68,7 +71,40 @@
               #chown -R '${data.user}:${data.group}' '${data.webroot}/.well-known/acme-challenge'
             '';
           in
-            "+${script}";
+          "+${script}";
+        # This is a workaround to
+        # https://github.com/NixOS/nixpkgs/issues/84409
+        # https://github.com/NixOS/nixpkgs/issues/84633
+        serviceConfig.RemainAfterExit = lib.mkForce false;
+        serviceConfig.WorkingDirectory = lib.mkForce "/var/lib/acme/${k}/.lego";
+        serviceConfig.StateDirectory = lib.mkForce "acme/${k}/.lego acme/${k}";
+        serviceConfig.ExecStartPost =
+          let
+            keyName = builtins.replaceStrings ["*"] ["_"] data.domain;
+            fileMode = if data.allowKeysForGroup then "640" else "600";
+            spath = "/var/lib/acme/${k}/.lego";
+            script = pkgs.writeScript "acme-post-start" ''
+              #!${pkgs.runtimeShell} -e
+              cd /var/lib/acme/${k}
+
+              # Test that existing cert is older than new cert
+              KEY=${spath}/certificates/${keyName}.key
+              if [ -e $KEY -a $KEY -nt key.pem ]; then
+                cp -p ${spath}/certificates/${keyName}.key key.pem
+                cp -p ${spath}/certificates/${keyName}.crt fullchain.pem
+                cp -p ${spath}/certificates/${keyName}.issuer.crt chain.pem
+                ln -sf fullchain.pem cert.pem
+                cat key.pem fullchain.pem > full.pem
+
+                ${data.postRun}
+              fi
+
+              chmod ${fileMode} *.pem
+              chown '${data.user}:${data.group}' *.pem
+            '';
+          in
+            lib.mkForce "+${script}";
+
       }
     ) config.security.acme.certs //
     {