Use acme directory config rather than hardcoding the value

diff --git a/modules/private/databases/mariadb.nix b/modules/private/databases/mariadb.nix
index 21f4359957f8be4225f070d5bd52f8a2e4c57a7b..cc99c3c6172da88d2c22766bee8aa3bf05b979d0 100644 (file)
--- a/modules/private/databases/mariadb.nix
+++ b/modules/private/databases/mariadb.nix
@@ -54,8 +54,8 @@ in {
       dataDir = cfg.dataDir;
       extraOptions = ''
         ssl_ca = ${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt
-        ssl_key = /var/lib/acme/mysql/key.pem
-        ssl_cert = /var/lib/acme/mysql/fullchain.pem
+        ssl_key = ${config.security.acme.directory}/mysql/key.pem
+        ssl_cert = ${config.security.acme.directory}/mysql/fullchain.pem
         '';
     };
 

diff --git a/modules/private/databases/openldap/default.nix b/modules/private/databases/openldap/default.nix
index 850f3ff3fbdbc1cd0f4acab3d34e3ddad12ea70c..46f85d26f0ca6f1da3358690ee5eee78334e97cb 100644 (file)
--- a/modules/private/databases/openldap/default.nix
+++ b/modules/private/databases/openldap/default.nix
@@ -33,9 +33,9 @@ let
     directory       ${cfg.dataDir}
     overlay         memberof
 
-    TLSCertificateFile    /var/lib/acme/ldap/cert.pem
-    TLSCertificateKeyFile /var/lib/acme/ldap/key.pem
-    TLSCACertificateFile  /var/lib/acme/ldap/fullchain.pem
+    TLSCertificateFile    ${config.security.acme.directory}/ldap/cert.pem
+    TLSCertificateKeyFile ${config.security.acme.directory}/ldap/key.pem
+    TLSCACertificateFile  ${config.security.acme.directory}/ldap/fullchain.pem
     TLSCACertificatePath  ${pkgs.cacert.unbundled}/etc/ssl/certs/
     #This makes openldap crash
     #TLSCipherSuite        DEFAULT

diff --git a/modules/private/databases/postgresql.nix b/modules/private/databases/postgresql.nix
index 26242a8e02a2a25b00c321f3dae922ea5c7d0159..8c36d84e0ccbab15e68b555c4d46008861fd5ffc 100644 (file)
--- a/modules/private/databases/postgresql.nix
+++ b/modules/private/databases/postgresql.nix
@@ -73,8 +73,8 @@ in {
         lc_time = 'en_US.UTF-8'
         default_text_search_config = 'pg_catalog.english'
         ssl = on
-        ssl_cert_file = '/var/lib/acme/postgresql/fullchain.pem'
-        ssl_key_file = '/var/lib/acme/postgresql/key.pem'
+        ssl_cert_file = '${config.security.acme.directory}/postgresql/fullchain.pem'
+        ssl_key_file = '${config.security.acme.directory}/postgresql/key.pem'
         '';
       authentication = ''
         local  all     postgres                                ident

diff --git a/modules/websites/default.nix b/modules/websites/default.nix
index b76aeead489cea4b2810c9f2537637489c835506..e57f505a86fae43fc3b523c5f9210db6b82a7895 100644 (file)
--- a/modules/websites/default.nix
+++ b/modules/websites/default.nix
@@ -102,7 +102,7 @@ in
       serverAliases = [ "*" ];
       enableSSL = false;
       logFormat = "combinedVhost";
-      documentRoot = "/var/lib/acme/acme-challenge";
+      documentRoot = "${config.security.acme.directory}/acme-challenge";
       extraConfig = ''
         RewriteEngine on
         RewriteCond "%{REQUEST_URI}"   "!^/\.well-known"
@@ -131,9 +131,9 @@ in
     };
     toVhost = ips: vhostConf: {
       enableSSL = true;
-      sslServerCert = "/var/lib/acme/${vhostConf.certName}/cert.pem";
-      sslServerKey = "/var/lib/acme/${vhostConf.certName}/key.pem";
-      sslServerChain = "/var/lib/acme/${vhostConf.certName}/chain.pem";
+      sslServerCert = "${config.security.acme.directory}/${vhostConf.certName}/cert.pem";
+      sslServerKey = "${config.security.acme.directory}/${vhostConf.certName}/key.pem";
+      sslServerChain = "${config.security.acme.directory}/${vhostConf.certName}/chain.pem";
       logFormat = "combinedVhost";
       listen = map (ip: { inherit ip; port = 443; }) ips;
       hostName = builtins.head vhostConf.hosts;

diff --git a/nixops/modules/certificates.nix b/nixops/modules/certificates.nix
index 9a9974e261d20c39aae804ee345c2636a296ed4a..72896fdab6b0ccb7fb2be272e82740d13897a78a 100644 (file)
--- a/nixops/modules/certificates.nix
+++ b/nixops/modules/certificates.nix
@@ -3,7 +3,7 @@
   options.services.myCertificates = {
     certConfig = lib.mkOption {
       default = {
-        webroot = "/var/lib/acme/acme-challenge";
+        webroot = "${config.security.acme.directory}/acme-challenge";
         email = "ismael@bouya.org";
         postRun = ''
           systemctl reload httpdTools.service httpdInte.service httpdProd.service
@@ -29,14 +29,14 @@
     systemd.services = lib.attrsets.mapAttrs' (k: v:
       lib.attrsets.nameValuePair "acme-selfsigned-${k}" (lib.mkBefore { script =
         (lib.optionalString (builtins.elem "cert.pem" v.plugins) ''
-        cp $workdir/server.crt /var/lib/acme/${k}/cert.pem
-        chown '${v.user}:${v.group}' /var/lib/acme/${k}/cert.pem
-        chmod ${if v.allowKeysForGroup then "750" else "700"} /var/lib/acme/${k}/cert.pem
+        cp $workdir/server.crt ${config.security.acme.directory}/${k}/cert.pem
+        chown '${v.user}:${v.group}' ${config.security.acme.directory}/${k}/cert.pem
+        chmod ${if v.allowKeysForGroup then "750" else "700"} ${config.security.acme.directory}/${k}/cert.pem
         '') +
         (lib.optionalString (builtins.elem "chain.pem" v.plugins) ''
-        cp $workdir/ca.crt /var/lib/acme/${k}/chain.pem
-        chown '${v.user}:${v.group}' /var/lib/acme/${k}/chain.pem
-        chmod ${if v.allowKeysForGroup then "750" else "700"} /var/lib/acme/${k}/chain.pem
+        cp $workdir/ca.crt ${config.security.acme.directory}/${k}/chain.pem
+        chown '${v.user}:${v.group}' ${config.security.acme.directory}/${k}/chain.pem
+        chmod ${if v.allowKeysForGroup then "750" else "700"} ${config.security.acme.directory}/${k}/chain.pem
         '')
       ; })
     ) config.security.acme.certs // {

diff --git a/nixops/modules/ftp.nix b/nixops/modules/ftp.nix
index 871e9efad87fa0848997ee277cd576f1d9002fae..842d2d6540bbe65d0347c3989d0f243a24884b9f 100644 (file)
--- a/nixops/modules/ftp.nix
+++ b/nixops/modules/ftp.nix
@@ -102,7 +102,7 @@
         MaxDiskUsage                 99
         CustomerProof                yes
         TLS                          1
-        CertFile                     /var/lib/acme/ftp/full.pem
+        CertFile                     ${config.security.acme.directory}/ftp/full.pem
         '';
     in {
       description = "Pure-FTPd server";

diff --git a/nixops/modules/irc.nix b/nixops/modules/irc.nix
index a4f6f93af428415b042e2fc3d8e6f16c0105b4e8..363bfef6b3b6f3801e78e5f6f6548f2d57d247a8 100644 (file)
--- a/nixops/modules/irc.nix
+++ b/nixops/modules/irc.nix
@@ -40,7 +40,7 @@
         bitlbee = {
           accept = 6697;
           connect = 6667;
-          cert = "/var/lib/acme/irc/full.pem";
+          cert = "${config.security.acme.directory}/irc/full.pem";
         };
       };
     };

diff --git a/nixops/modules/task/default.nix b/nixops/modules/task/default.nix
index 426aa68f1f94ac348de2c8051cb007c7108a8469..e1c933f3e435dd4cc36bdaf6b574f1daff14136d 100644 (file)
--- a/nixops/modules/task/default.nix
+++ b/nixops/modules/task/default.nix
@@ -236,9 +236,9 @@ in {
       inherit fqdn;
       listenHost = "::";
       pki.manual.ca.cert = "${server_vardir}/keys/ca.cert";
-      pki.manual.server.cert = "/var/lib/acme/task/fullchain.pem";
-      pki.manual.server.crl = "/var/lib/acme/task/invalid.crl";
-      pki.manual.server.key = "/var/lib/acme/task/key.pem";
+      pki.manual.server.cert = "${config.security.acme.directory}/task/fullchain.pem";
+      pki.manual.server.crl = "${config.security.acme.directory}/task/invalid.crl";
+      pki.manual.server.key = "${config.security.acme.directory}/task/key.pem";
       requestLimit = 104857600;
     };
 

diff --git a/nixops/modules/websites/default.nix b/nixops/modules/websites/default.nix
index 5b839af9885c97a1b258133368b1723da1d7c381..432ad3c02466c26619c2df203327490d7b5d25a6 100644 (file)
--- a/nixops/modules/websites/default.nix
+++ b/nixops/modules/websites/default.nix
@@ -179,7 +179,7 @@ in
 
     system.activationScripts = {
       httpd = ''
-        install -d -m 0755 /var/lib/acme/acme-challenge
+        install -d -m 0755 ${config.security.acme.directory}/acme-challenge
         install -d -m 0750 -o wwwrun -g wwwrun /var/lib/php/sessions
         install -d -m 0750 -o wwwrun -g wwwrun /var/lib/php/sessions/adminer
         install -d -m 0750 -o wwwrun -g wwwrun /var/lib/php/tmp/adminer