Upgrade acme bot

20 files changed, 49 insertions, 49 deletions

diff --git a/modules/private/certificates.nix b/modules/private/certificates.nix
index 2d24579..f057200 100644
--- a/modules/private/certificates.nix
+++ b/modules/private/certificates.nix
@@ -4,7 +4,7 @@
     enable = lib.mkEnableOption "enable certificates";
     certConfig = lib.mkOption {
       default = {
-        webroot = "${config.security.acme.directory}/acme-challenge";
+        webroot = "/var/lib/acme/acme-challenge";
         email = "ismael@bouya.org";
         postRun = builtins.concatStringsSep "\n" [
           (lib.optionalString config.services.httpd.Prod.enable "systemctl reload httpdProd.service")
@@ -12,7 +12,7 @@
           (lib.optionalString config.services.httpd.Inte.enable "systemctl reload httpdInte.service")
           (lib.optionalString config.services.nginx.enable "systemctl reload nginx.service")
         ];
-        plugins = [ "cert.pem" "chain.pem" "fullchain.pem" "full.pem" "key.pem" "account_key.json" ];
+        plugins = [ "cert.pem" "chain.pem" "fullchain.pem" "full.pem" "key.pem" "account_key.json" "account_reg.json"];
       };
       description = "Default configuration for certificates";
     };
@@ -20,7 +20,7 @@
 
   config = lib.mkIf config.myServices.certificates.enable {
     services.duplyBackup.profiles.system.excludeFile = ''
-      + ${config.security.acme.directory}
+      + /var/lib/acme/acme-challenge
       '';
     services.nginx = {
       recommendedTlsSettings = true;
@@ -30,9 +30,9 @@
     myServices.databasesCerts = config.myServices.certificates.certConfig;
     myServices.ircCerts = config.myServices.certificates.certConfig;
 
-    security.acme.preliminarySelfsigned = true;
+    security.acme2.preliminarySelfsigned = true;
 
-    security.acme.certs = {
+    security.acme2.certs = {
       "${name}" = config.myServices.certificates.certConfig // {
         domain = config.hostEnv.fqdn;
       };
@@ -41,17 +41,17 @@
     systemd.services = lib.attrsets.mapAttrs' (k: v:
       lib.attrsets.nameValuePair "acme-selfsigned-${k}" (lib.mkBefore { script =
         (lib.optionalString (builtins.elem "cert.pem" v.plugins) ''
-        cp $workdir/server.crt ${config.security.acme.directory}/${k}/cert.pem
-        chown '${v.user}:${v.group}' ${config.security.acme.directory}/${k}/cert.pem
-        chmod ${if v.allowKeysForGroup then "750" else "700"} ${config.security.acme.directory}/${k}/cert.pem
+        cp $workdir/server.crt ${config.security.acme2.certs."${k}".directory}/cert.pem
+        chown '${v.user}:${v.group}' ${config.security.acme2.certs."${k}".directory}/cert.pem
+        chmod ${if v.allowKeysForGroup then "750" else "700"} ${config.security.acme2.certs."${k}".directory}/cert.pem
         '') +
         (lib.optionalString (builtins.elem "chain.pem" v.plugins) ''
-        cp $workdir/ca.crt ${config.security.acme.directory}/${k}/chain.pem
-        chown '${v.user}:${v.group}' ${config.security.acme.directory}/${k}/chain.pem
-        chmod ${if v.allowKeysForGroup then "750" else "700"} ${config.security.acme.directory}/${k}/chain.pem
+        cp $workdir/ca.crt ${config.security.acme2.certs."${k}".directory}/chain.pem
+        chown '${v.user}:${v.group}' ${config.security.acme2.certs."${k}".directory}/chain.pem
+        chmod ${if v.allowKeysForGroup then "750" else "700"} ${config.security.acme2.certs."${k}".directory}/chain.pem
         '')
       ; })
-    ) config.security.acme.certs // {
+    ) config.security.acme2.certs // {
       httpdProd = lib.mkIf config.services.httpd.Prod.enable
         { after = [ "acme-selfsigned-certificates.target" ]; wants = [ "acme-selfsigned-certificates.target" ]; };
       httpdTools = lib.mkIf config.services.httpd.Tools.enable
diff --git a/modules/private/databases/mariadb.nix b/modules/private/databases/mariadb.nix
index 3359064..ed647ea 100644
--- a/modules/private/databases/mariadb.nix
+++ b/modules/private/databases/mariadb.nix
@@ -96,8 +96,8 @@ in {
       dataDir = cfg.dataDir;
       extraOptions = ''
         ssl_ca = ${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt
-        ssl_key = ${config.security.acme.directory}/mysql/key.pem
-        ssl_cert = ${config.security.acme.directory}/mysql/fullchain.pem
+        ssl_key = ${config.security.acme2.certs.mysql.directory}/key.pem
+        ssl_cert = ${config.security.acme2.certs.mysql.directory}/fullchain.pem
 
         # for replication
         log-bin=mariadb-bin
@@ -110,10 +110,10 @@ in {
     };
 
     users.users.mysql.extraGroups = [ "keys" ];
-    security.acme.certs."mysql" = config.myServices.databasesCerts // {
+    security.acme2.certs."mysql" = config.myServices.databasesCerts // {
       user = "mysql";
       group = "mysql";
-      plugins = [ "fullchain.pem" "key.pem" "account_key.json" ];
+      plugins = [ "fullchain.pem" "key.pem" "account_key.json" "account_reg.json" ];
       domain = "db-1.immae.eu";
       postRun = ''
         systemctl restart mysql.service
diff --git a/modules/private/databases/openldap/default.nix b/modules/private/databases/openldap/default.nix
index 22f6f7b..d7d61db 100644
--- a/modules/private/databases/openldap/default.nix
+++ b/modules/private/databases/openldap/default.nix
@@ -24,9 +24,9 @@ let
     overlay         syncprov
     syncprov-checkpoint 100 10
 
-    TLSCertificateFile    ${config.security.acme.directory}/ldap/cert.pem
-    TLSCertificateKeyFile ${config.security.acme.directory}/ldap/key.pem
-    TLSCACertificateFile  ${config.security.acme.directory}/ldap/fullchain.pem
+    TLSCertificateFile    ${config.security.acme2.certs.ldap.directory}/cert.pem
+    TLSCertificateKeyFile ${config.security.acme2.certs.ldap.directory}/key.pem
+    TLSCACertificateFile  ${config.security.acme2.certs.ldap.directory}/fullchain.pem
     TLSCACertificatePath  ${pkgs.cacert.unbundled}/etc/ssl/certs/
     #This makes openldap crash
     #TLSCipherSuite        DEFAULT
@@ -117,10 +117,10 @@ in
     users.users.openldap.extraGroups = [ "keys" ];
     networking.firewall.allowedTCPPorts = [ 636 389 ];
 
-    security.acme.certs."ldap" = config.myServices.databasesCerts // {
+    security.acme2.certs."ldap" = config.myServices.databasesCerts // {
       user = "openldap";
       group = "openldap";
-      plugins = [ "fullchain.pem" "key.pem" "cert.pem" "account_key.json" ];
+      plugins = [ "fullchain.pem" "key.pem" "cert.pem" "account_key.json" "account_reg.json" ];
       domain = "ldap.immae.eu";
       postRun = ''
         systemctl restart openldap.service
diff --git a/modules/private/databases/postgresql.nix b/modules/private/databases/postgresql.nix
index 3dcd311..27ea59c 100644
--- a/modules/private/databases/postgresql.nix
+++ b/modules/private/databases/postgresql.nix
@@ -107,10 +107,10 @@ in {
   config = lib.mkIf cfg.enable {
     networking.firewall.allowedTCPPorts = [ 5432 ];
 
-    security.acme.certs."postgresql" = config.myServices.databasesCerts // {
+    security.acme2.certs."postgresql" = config.myServices.databasesCerts // {
       user = "postgres";
       group = "postgres";
-      plugins = [ "fullchain.pem" "key.pem" "account_key.json" ];
+      plugins = [ "fullchain.pem" "key.pem" "account_key.json" "account_reg.json" ];
       domain = "db-1.immae.eu";
       postRun = ''
         systemctl reload postgresql.service
@@ -165,8 +165,8 @@ in {
         # makes it order of magnitudes quicker
         synchronous_commit = off
         ssl = on
-        ssl_cert_file = '${config.security.acme.directory}/postgresql/fullchain.pem'
-        ssl_key_file = '${config.security.acme.directory}/postgresql/key.pem'
+        ssl_cert_file = '${config.security.acme2.certs.postgresql.directory}/fullchain.pem'
+        ssl_key_file = '${config.security.acme2.certs.postgresql.directory}/key.pem'
         '';
       authentication = let
         hosts = builtins.concatStringsSep "\n" (
diff --git a/modules/private/ejabberd/default.nix b/modules/private/ejabberd/default.nix
index 5e717f4..3537c24 100644
--- a/modules/private/ejabberd/default.nix
+++ b/modules/private/ejabberd/default.nix
@@ -14,7 +14,7 @@ in
   };
 
   config = lib.mkIf cfg.enable {
-    security.acme.certs = {
+    security.acme2.certs = {
       "ejabberd" = config.myServices.certificates.certConfig // {
         user = "ejabberd";
         group = "ejabberd";
@@ -58,7 +58,7 @@ in
         text = ''
           host_config:
             "immae.fr":
-              domain_certfile: "${config.security.acme.directory}/ejabberd/full.pem"
+              domain_certfile: "${config.security.acme2.certs.ejabberd.directory}/full.pem"
               auth_method: [ldap]
               ldap_servers: ["${config.myEnv.jabber.ldap.host}"]
               ldap_encrypt: tls
@@ -81,7 +81,7 @@ in
         ERLANG_NODE=ejabberd@localhost
       '';
       configFile = pkgs.runCommand "ejabberd.yml" {
-        certificatePrivateKeyAndFullChain = "${config.security.acme.directory}/ejabberd/full.pem";
+        certificatePrivateKeyAndFullChain = "${config.security.acme2.certs.ejabberd.directory}/full.pem";
         certificateCA = "${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt";
         sql_config_file = config.secrets.fullPaths."ejabberd/psql.yml";
         host_config_file = config.secrets.fullPaths."ejabberd/host.yml";
diff --git a/modules/private/ftp.nix b/modules/private/ftp.nix
index e3c1f70..585fe63 100644
--- a/modules/private/ftp.nix
+++ b/modules/private/ftp.nix
@@ -17,7 +17,7 @@ in
     services.duplyBackup.profiles.ftp = {
       rootDir = "/var/lib/ftp";
     };
-    security.acme.certs."ftp" = config.myServices.certificates.certConfig // {
+    security.acme2.certs."ftp" = config.myServices.certificates.certConfig // {
       domain = "eldiron.immae.eu";
       postRun = ''
         systemctl restart pure-ftpd.service
@@ -113,7 +113,7 @@ in
         MaxDiskUsage                 99
         CustomerProof                yes
         TLS                          1
-        CertFile                     ${config.security.acme.directory}/ftp/full.pem
+        CertFile                     ${config.security.acme2.certs.ftp.directory}/full.pem
         '';
     in {
       description = "Pure-FTPd server";
diff --git a/modules/private/irc.nix b/modules/private/irc.nix
index 4e6eaab..1054b96 100644
--- a/modules/private/irc.nix
+++ b/modules/private/irc.nix
@@ -20,7 +20,7 @@ in
     services.duplyBackup.profiles.irc = {
       rootDir = "/var/lib/bitlbee";
     };
-    security.acme.certs."irc" = config.myServices.ircCerts // {
+    security.acme2.certs."irc" = config.myServices.ircCerts // {
       domain = "irc.immae.eu";
       postRun = ''
         systemctl restart stunnel.service
@@ -49,7 +49,7 @@ in
         bitlbee = {
           accept = 6697;
           connect = 6667;
-          cert = "${config.security.acme.directory}/irc/full.pem";
+          cert = "${config.security.acme2.certs.irc.directory}/full.pem";
         };
       };
     };
diff --git a/modules/private/mail/default.nix b/modules/private/mail/default.nix
index b50e346..1c64e15 100644
--- a/modules/private/mail/default.nix
+++ b/modules/private/mail/default.nix
@@ -13,7 +13,7 @@
   options.myServices.mailBackup.enable = lib.mkEnableOption "enable MX backup services";
 
   config = lib.mkIf config.myServices.mail.enable {
-    security.acme.certs."mail" = config.myServices.certificates.certConfig // {
+    security.acme2.certs."mail" = config.myServices.certificates.certConfig // {
       domain = config.hostEnv.fqdn;
       extraDomains = let
         zonesWithMx = builtins.filter (zone:
diff --git a/modules/private/mail/dovecot.nix b/modules/private/mail/dovecot.nix
index 4facef5..523c017 100644
--- a/modules/private/mail/dovecot.nix
+++ b/modules/private/mail/dovecot.nix
@@ -269,7 +269,7 @@ in
       [
         "0 2 * * * root ${cron_script}/bin/cleanup-imap-folders"
       ];
-    security.acme.certs."mail" = {
+    security.acme2.certs."mail" = {
       postRun = ''
         systemctl restart dovecot2.service
       '';
diff --git a/modules/private/mail/postfix.nix b/modules/private/mail/postfix.nix
index bd284cb..8fe06da 100644
--- a/modules/private/mail/postfix.nix
+++ b/modules/private/mail/postfix.nix
@@ -417,7 +417,7 @@
         };
       };
     };
-    security.acme.certs."mail" = {
+    security.acme2.certs."mail" = {
       postRun = ''
         systemctl restart postfix.service
         '';
diff --git a/modules/private/mail/relay.nix b/modules/private/mail/relay.nix
index 9111350..e0aa387 100644
--- a/modules/private/mail/relay.nix
+++ b/modules/private/mail/relay.nix
@@ -1,7 +1,7 @@
 { lib, pkgs, config, nodes, name, ... }:
 {
   config = lib.mkIf config.myServices.mailBackup.enable {
-    security.acme.certs."mail" = config.myServices.certificates.certConfig // {
+    security.acme2.certs."mail" = config.myServices.certificates.certConfig // {
       postRun = ''
         systemctl restart postfix.service
         '';
diff --git a/modules/private/monitoring/status.nix b/modules/private/monitoring/status.nix
index d25d934..2860e96 100644
--- a/modules/private/monitoring/status.nix
+++ b/modules/private/monitoring/status.nix
@@ -34,7 +34,7 @@
         locations."/".proxyPass = "http://unix:/run/naemon-status/socket.sock:/";
       };
     };
-    security.acme.certs."${name}".extraDomains."status.immae.eu" = null;
+    security.acme2.certs."${name}".extraDomains."status.immae.eu" = null;
 
     myServices.certificates.enable = true;
     networking.firewall.allowedTCPPorts = [ 80 443 ];
diff --git a/modules/private/tasks/default.nix b/modules/private/tasks/default.nix
index c4f065b..c0cc87b 100644
--- a/modules/private/tasks/default.nix
+++ b/modules/private/tasks/default.nix
@@ -192,9 +192,9 @@ in {
 
     myServices.websites.webappDirs._task = ./www;
 
-    security.acme.certs."task" = config.myServices.certificates.certConfig // {
+    security.acme2.certs."task" = config.myServices.certificates.certConfig // {
       inherit user group;
-      plugins = [ "fullchain.pem" "key.pem" "cert.pem" "account_key.json" ];
+      plugins = [ "fullchain.pem" "key.pem" "cert.pem" "account_key.json" "account_reg.json" ];
       domain = fqdn;
       postRun = ''
         systemctl restart taskserver.service
@@ -244,9 +244,9 @@ in {
       inherit fqdn;
       listenHost = "::";
       pki.manual.ca.cert = "${server_vardir}/keys/ca.cert";
-      pki.manual.server.cert = "${config.security.acme.directory}/task/fullchain.pem";
-      pki.manual.server.crl = "${config.security.acme.directory}/task/invalid.crl";
-      pki.manual.server.key = "${config.security.acme.directory}/task/key.pem";
+      pki.manual.server.cert = "${config.security.acme2.certs.task.directory}/fullchain.pem";
+      pki.manual.server.crl = "${config.security.acme2.certs.task.directory}/invalid.crl";
+      pki.manual.server.key = "${config.security.acme2.certs.task.directory}/key.pem";
       requestLimit = 104857600;
     };
 
diff --git a/modules/private/websites/default.nix b/modules/private/websites/default.nix
index 7f3e463..90f24a4 100644
--- a/modules/private/websites/default.nix
+++ b/modules/private/websites/default.nix
@@ -125,7 +125,7 @@ in
 
     system.activationScripts = {
       httpd = ''
-        install -d -m 0755 ${config.security.acme.directory}/acme-challenge
+        install -d -m 0755 /var/lib/acme/acme-challenge
         install -d -m 0750 -o wwwrun -g wwwrun /var/lib/php/sessions
         '';
     };
diff --git a/modules/private/websites/florian/integration.nix b/modules/private/websites/florian/integration.nix
index 00de761..ef7d13a 100644
--- a/modules/private/websites/florian/integration.nix
+++ b/modules/private/websites/florian/integration.nix
@@ -8,7 +8,7 @@ in {
   options.myServices.websites.florian.integration.enable = lib.mkEnableOption "enable Florian's website integration";
 
   config = lib.mkIf cfg.enable {
-    security.acme.certs."ftp".extraDomains."florian.immae.eu" = null;
+    security.acme2.certs."ftp".extraDomains."florian.immae.eu" = null;
 
     services.websites.env.integration.modules = adminer.apache.modules;
     services.websites.env.integration.vhostConfs.florian = {
diff --git a/modules/private/websites/florian/production.nix b/modules/private/websites/florian/production.nix
index 8d3dfb0..1abc715 100644
--- a/modules/private/websites/florian/production.nix
+++ b/modules/private/websites/florian/production.nix
@@ -8,7 +8,7 @@ in {
   options.myServices.websites.florian.production.enable = lib.mkEnableOption "enable Florian's website production";
 
   config = lib.mkIf cfg.enable {
-    security.acme.certs."ftp".extraDomains."tellesflorian.com" = null;
+    security.acme2.certs."ftp".extraDomains."tellesflorian.com" = null;
 
     services.websites.env.production.modules = adminer.apache.modules;
     services.websites.env.production.vhostConfs.florian = {
diff --git a/modules/private/websites/nassime/production.nix b/modules/private/websites/nassime/production.nix
index f9468f9..293519f 100644
--- a/modules/private/websites/nassime/production.nix
+++ b/modules/private/websites/nassime/production.nix
@@ -9,7 +9,7 @@ in {
   config = lib.mkIf cfg.enable {
     services.webstats.sites = [ { name = "nassime.bouya.org"; } ];
 
-    security.acme.certs."ftp".extraDomains."nassime.bouya.org" = null;
+    security.acme2.certs."ftp".extraDomains."nassime.bouya.org" = null;
 
     services.websites.env.production.vhostConfs.nassime = {
       certName     = "nassime";
diff --git a/modules/private/websites/naturaloutil/production.nix b/modules/private/websites/naturaloutil/production.nix
index 628e129..a276c47 100644
--- a/modules/private/websites/naturaloutil/production.nix
+++ b/modules/private/websites/naturaloutil/production.nix
@@ -10,7 +10,7 @@ in {
   config = lib.mkIf cfg.enable {
     services.webstats.sites = [ { name = "naturaloutil.immae.eu"; } ];
 
-    security.acme.certs."ftp".extraDomains."naturaloutil.immae.eu" = null;
+    security.acme2.certs."ftp".extraDomains."naturaloutil.immae.eu" = null;
 
     secrets.keys = [{
       dest = "webapps/prod-naturaloutil";
diff --git a/modules/private/websites/papa/surveillance.nix b/modules/private/websites/papa/surveillance.nix
index 1bb6ac8..f6e1772 100644
--- a/modules/private/websites/papa/surveillance.nix
+++ b/modules/private/websites/papa/surveillance.nix
@@ -6,7 +6,7 @@ in {
   options.myServices.websites.papa.surveillance.enable = lib.mkEnableOption "enable Papa surveillance's website";
 
   config = lib.mkIf cfg.enable {
-    security.acme.certs."ftp".extraDomains."surveillance.maison.bbc.bouya.org" = null;
+    security.acme2.certs."ftp".extraDomains."surveillance.maison.bbc.bouya.org" = null;
 
     services.cron = {
       systemCronJobs = let
diff --git a/modules/private/websites/teliotortay/production.nix b/modules/private/websites/teliotortay/production.nix
index 59090f5..2c62d10 100644
--- a/modules/private/websites/teliotortay/production.nix
+++ b/modules/private/websites/teliotortay/production.nix
@@ -10,7 +10,7 @@ in {
   config = lib.mkIf cfg.enable {
     services.webstats.sites = [ { name = "telio-tortay.immae.eu"; } ];
 
-    security.acme.certs."ftp".extraDomains."telio-tortay.immae.eu" = null;
+    security.acme2.certs."ftp".extraDomains."telio-tortay.immae.eu" = null;
 
     system.activationScripts.telio-tortay = {
       deps = [ "httpd" ];