X-Git-Url: https://git.immae.eu/?a=blobdiff_plain;f=modules%2Fprivate%2Fdatabases%2Fpostgresql.nix;h=27ea59cbf6fd561c78e815f363f7617efa302b14;hb=981fa80354fd6f00f49446777c38f77bd8a65f65;hp=1932a824ac9f73072f700e9cd98256ea9e43d4e0;hpb=ec9b656476d4af2784aea29b846bead85dc46e16;p=perso%2FImmae%2FConfig%2FNix.git

diff --git a/modules/private/databases/postgresql.nix b/modules/private/databases/postgresql.nix
index 1932a82..27ea59c 100644
--- a/modules/private/databases/postgresql.nix
+++ b/modules/private/databases/postgresql.nix
@@ -107,10 +107,10 @@ in {
   config = lib.mkIf cfg.enable {
     networking.firewall.allowedTCPPorts = [ 5432 ];
 
-    security.acme.certs."postgresql" = config.myServices.databasesCerts // {
+    security.acme2.certs."postgresql" = config.myServices.databasesCerts // {
       user = "postgres";
       group = "postgres";
-      plugins = [ "fullchain.pem" "key.pem" "account_key.json" ];
+      plugins = [ "fullchain.pem" "key.pem" "account_key.json" "account_reg.json" ];
       domain = "db-1.immae.eu";
       postRun = ''
         systemctl reload postgresql.service
@@ -161,9 +161,12 @@ in {
         lc_numeric = 'en_US.UTF-8'
         lc_time = 'en_US.UTF-8'
         default_text_search_config = 'pg_catalog.english'
+        # this introduces a small delay before storing on disk, but
+        # makes it order of magnitudes quicker
+        synchronous_commit = off
         ssl = on
-        ssl_cert_file = '${config.security.acme.directory}/postgresql/fullchain.pem'
-        ssl_key_file = '${config.security.acme.directory}/postgresql/key.pem'
+        ssl_cert_file = '${config.security.acme2.certs.postgresql.directory}/fullchain.pem'
+        ssl_key_file = '${config.security.acme2.certs.postgresql.directory}/key.pem'
         '';
       authentication = let
         hosts = builtins.concatStringsSep "\n" (