Upgrade to latest nixos

[perso/Immae/Config/Nix.git] / modules / private / certificates.nix

diff --git a/modules/private/certificates.nix b/modules/private/certificates.nix
index 82ff52f04ba0f437966e6fdbff7472cb2bf6e645..bbe4c3bbf1c093510aed37622d30aa149ab3729b 100644 (file)
--- a/modules/private/certificates.nix
+++ b/modules/private/certificates.nix
@@ -4,7 +4,7 @@
     enable = lib.mkEnableOption "enable certificates";
     certConfig = lib.mkOption {
       default = {
-        webroot = "/var/lib/acme/acme-challenge";
+        webroot = "/var/lib/acme/acme-challenges";
         email = "ismael@bouya.org";
         postRun = builtins.concatStringsSep "\n" [
           (lib.optionalString config.services.httpd.Prod.enable "systemctl reload httpdProd.service")
@@ -12,6 +12,7 @@
           (lib.optionalString config.services.httpd.Inte.enable "systemctl reload httpdInte.service")
           (lib.optionalString config.services.nginx.enable "systemctl reload nginx.service")
         ];
+        extraLegoRenewFlags = [ "--reuse-key" ];
       };
       description = "Default configuration for certificates";
     };
@@ -19,11 +20,17 @@
 
   config = lib.mkIf config.myServices.certificates.enable {
     services.duplyBackup.profiles.system.excludeFile = ''
-      + /var/lib/acme/acme-challenge
+      + /var/lib/acme/acme-challenges
       '';
     services.nginx = {
       recommendedTlsSettings = true;
-      virtualHosts = { "${config.hostEnv.fqdn}" = { useACMEHost = name; forceSSL = true; }; };
+      virtualHosts = {
+        "${config.hostEnv.fqdn}" = {
+          acmeRoot = config.security.acme.certs."${name}".webroot;
+          useACMEHost = name;
+          forceSSL = true;
+        };
+      };
     };
     services.websites.certs = config.myServices.certificates.certConfig;
     myServices.databasesCerts = config.myServices.certificates.certConfig;
@@ -39,19 +46,22 @@
     };
 
     systemd.services = lib.attrsets.mapAttrs' (k: v:
-      lib.attrsets.nameValuePair "acme-selfsigned-${k}" { script = lib.mkBefore ''
-        cp $workdir/server.crt ${config.security.acme.certs."${k}".directory}/cert.pem
-        chown '${v.user}:${v.group}' ${config.security.acme.certs."${k}".directory}/cert.pem
-        chmod ${if v.allowKeysForGroup then "750" else "700"} ${config.security.acme.certs."${k}".directory}/cert.pem
+      lib.attrsets.nameValuePair "acme-selfsigned-${k}" {
+          wantedBy = [ "acme-selfsigned-certificates.target" ];
+          script = lib.mkAfter ''
+          cp $workdir/server.crt ${config.security.acme.certs."${k}".directory}/cert.pem
+          chown '${v.user}:${v.group}' ${config.security.acme.certs."${k}".directory}/cert.pem
+          chmod ${if v.allowKeysForGroup then "750" else "700"} ${config.security.acme.certs."${k}".directory}/cert.pem
 
-        cp $workdir/ca.crt ${config.security.acme.certs."${k}".directory}/chain.pem
-        chown '${v.user}:${v.group}' ${config.security.acme.certs."${k}".directory}/chain.pem
-        chmod ${if v.allowKeysForGroup then "750" else "700"} ${config.security.acme.certs."${k}".directory}/chain.pem
-        '';
-      }
-    ) config.security.acme.certs //
+          cp $workdir/ca.crt ${config.security.acme.certs."${k}".directory}/chain.pem
+          chown '${v.user}:${v.group}' ${config.security.acme.certs."${k}".directory}/chain.pem
+          chmod ${if v.allowKeysForGroup then "750" else "700"} ${config.security.acme.certs."${k}".directory}/chain.pem
+          '';
+        }
+      ) config.security.acme.certs //
     lib.attrsets.mapAttrs' (k: data:
       lib.attrsets.nameValuePair "acme-${k}" {
+        after = lib.mkAfter [ "bind.service" ];
         serviceConfig.ExecStartPre =
           let
             script = pkgs.writeScript "acme-pre-start" ''
@@ -62,7 +72,40 @@
               #chown -R '${data.user}:${data.group}' '${data.webroot}/.well-known/acme-challenge'
             '';
           in
-            "+${script}";
+          "+${script}";
+        # This is a workaround to
+        # https://github.com/NixOS/nixpkgs/issues/84409
+        # https://github.com/NixOS/nixpkgs/issues/84633
+        serviceConfig.RemainAfterExit = lib.mkForce false;
+        serviceConfig.WorkingDirectory = lib.mkForce "/var/lib/acme/${k}/.lego";
+        serviceConfig.StateDirectory = lib.mkForce "acme/${k}/.lego acme/${k} acme/.lego/${k} acme/.lego/accounts";
+        serviceConfig.ExecStartPost =
+          let
+            keyName = builtins.replaceStrings ["*"] ["_"] data.domain;
+            fileMode = if data.allowKeysForGroup then "640" else "600";
+            spath = "/var/lib/acme/${k}/.lego";
+            script = pkgs.writeScript "acme-post-start" ''
+              #!${pkgs.runtimeShell} -e
+              cd /var/lib/acme/${k}
+
+              # Test that existing cert is older than new cert
+              KEY=${spath}/certificates/${keyName}.key
+              if [ -e $KEY -a $KEY -nt key.pem ]; then
+                cp -p ${spath}/certificates/${keyName}.key key.pem
+                cp -p ${spath}/certificates/${keyName}.crt fullchain.pem
+                cp -p ${spath}/certificates/${keyName}.issuer.crt chain.pem
+                ln -sf fullchain.pem cert.pem
+                cat key.pem fullchain.pem > full.pem
+
+                ${data.postRun}
+              fi
+
+              chmod ${fileMode} *.pem
+              chown '${data.user}:${data.group}' *.pem
+            '';
+          in
+            lib.mkForce "+${script}";
+
       }
     ) config.security.acme.certs //
     {