Fix acme challenge folders

diff --git a/modules/private/certificates.nix b/modules/private/certificates.nix
index 82ff52f04ba0f437966e6fdbff7472cb2bf6e645..c68bbee5f585d4bdf69376a687180c9cf9e92e78 100644 (file)
--- a/modules/private/certificates.nix
+++ b/modules/private/certificates.nix
@@ -4,7 +4,7 @@
     enable = lib.mkEnableOption "enable certificates";
     certConfig = lib.mkOption {
       default = {
-        webroot = "/var/lib/acme/acme-challenge";
+        webroot = "/var/lib/acme/acme-challenges";
         email = "ismael@bouya.org";
         postRun = builtins.concatStringsSep "\n" [
           (lib.optionalString config.services.httpd.Prod.enable "systemctl reload httpdProd.service")
@@ -19,11 +19,17 @@
 
   config = lib.mkIf config.myServices.certificates.enable {
     services.duplyBackup.profiles.system.excludeFile = ''
-      + /var/lib/acme/acme-challenge
+      + /var/lib/acme/acme-challenges
       '';
     services.nginx = {
       recommendedTlsSettings = true;
-      virtualHosts = { "${config.hostEnv.fqdn}" = { useACMEHost = name; forceSSL = true; }; };
+      virtualHosts = {
+        "${config.hostEnv.fqdn}" = {
+          acmeRoot = config.security.acme.certs."${name}".webroot;
+          useACMEHost = name;
+          forceSSL = true;
+        };
+      };
     };
     services.websites.certs = config.myServices.certificates.certConfig;
     myServices.databasesCerts = config.myServices.certificates.certConfig;

diff --git a/modules/private/monitoring/status.nix b/modules/private/monitoring/status.nix
index 7810a1f8e90e2edf9a5d43aa902e56c92d28f7e4..e0bc0e1c29611954c3fe00949575dbb481a7b693 100644 (file)
--- a/modules/private/monitoring/status.nix
+++ b/modules/private/monitoring/status.nix
@@ -29,6 +29,7 @@
       recommendedGzipSettings = true;
       recommendedProxySettings = true;
       virtualHosts."status.immae.eu" = {
+        acmeRoot = config.security.acme.certs."${name}".webroot;
         useACMEHost = name;
         forceSSL = true;
         locations."/".proxyPass = "http://unix:/run/naemon-status/socket.sock:/";

diff --git a/modules/private/websites/default.nix b/modules/private/websites/default.nix
index 529ec5ced31226e0bfeb6966efab0f42f5c3c07f..f9689ecc6cbcb65dff8245254ed12d7643443ff5 100644 (file)
--- a/modules/private/websites/default.nix
+++ b/modules/private/websites/default.nix
@@ -125,7 +125,7 @@ in
 
     system.activationScripts = {
       httpd = ''
-        install -d -m 0755 /var/lib/acme/acme-challenge
+        install -d -m 0755 /var/lib/acme/acme-challenges
         install -d -m 0750 -o wwwrun -g wwwrun /var/lib/php/sessions
         '';
     };