X-Git-Url: https://git.immae.eu/?a=blobdiff_plain;f=nixops%2Fmodules%2Fcertificates.nix;h=43f6a2343afafeba86880779f6aa66afc75c6447;hb=ffb14c1c25280777f5db3d2129c48dd319381f65;hp=08f84fd1786c1a1ee13ae01b6071852b4ec3ecb7;hpb=017cb76f3355369a57cee7e851e013fbe7b265b7;p=perso%2FImmae%2FConfig%2FNix.git

diff --git a/nixops/modules/certificates.nix b/nixops/modules/certificates.nix
index 08f84fd..43f6a23 100644
--- a/nixops/modules/certificates.nix
+++ b/nixops/modules/certificates.nix
@@ -3,7 +3,7 @@
   options.services.myCertificates = {
     certConfig = lib.mkOption {
       default = {
-        webroot = "/var/lib/acme/acme-challenge";
+        webroot = "${config.security.acme.directory}/acme-challenge";
         email = "ismael@bouya.org";
         postRun = ''
           systemctl reload httpdTools.service httpdInte.service httpdProd.service
@@ -15,6 +15,10 @@
   };
 
   config = {
+    services.websitesCerts = config.services.myCertificates.certConfig;
+    myServices.databasesCerts = config.services.myCertificates.certConfig;
+    myServices.ircCerts = config.services.myCertificates.certConfig;
+
     security.acme.preliminarySelfsigned = true;
 
     security.acme.certs = {
@@ -26,14 +30,14 @@
     systemd.services = lib.attrsets.mapAttrs' (k: v:
       lib.attrsets.nameValuePair "acme-selfsigned-${k}" (lib.mkBefore { script =
         (lib.optionalString (builtins.elem "cert.pem" v.plugins) ''
-        cp $workdir/server.crt /var/lib/acme/${k}/cert.pem
-        chown '${v.user}:${v.group}' /var/lib/acme/${k}/cert.pem
-        chmod ${if v.allowKeysForGroup then "750" else "700"} /var/lib/acme/${k}/cert.pem
+        cp $workdir/server.crt ${config.security.acme.directory}/${k}/cert.pem
+        chown '${v.user}:${v.group}' ${config.security.acme.directory}/${k}/cert.pem
+        chmod ${if v.allowKeysForGroup then "750" else "700"} ${config.security.acme.directory}/${k}/cert.pem
         '') +
         (lib.optionalString (builtins.elem "chain.pem" v.plugins) ''
-        cp $workdir/ca.crt /var/lib/acme/${k}/chain.pem
-        chown '${v.user}:${v.group}' /var/lib/acme/${k}/chain.pem
-        chmod ${if v.allowKeysForGroup then "750" else "700"} /var/lib/acme/${k}/chain.pem
+        cp $workdir/ca.crt ${config.security.acme.directory}/${k}/chain.pem
+        chown '${v.user}:${v.group}' ${config.security.acme.directory}/${k}/chain.pem
+        chmod ${if v.allowKeysForGroup then "750" else "700"} ${config.security.acme.directory}/${k}/chain.pem
         '')
       ; })
     ) config.security.acme.certs // {