aboutsummaryrefslogtreecommitdiff
path: root/nixops
diff options
context:
space:
mode:
Diffstat (limited to 'nixops')
-rw-r--r--nixops/modules/certificates.nix14
-rw-r--r--nixops/modules/ftp.nix2
-rw-r--r--nixops/modules/irc.nix2
-rw-r--r--nixops/modules/task/default.nix6
-rw-r--r--nixops/modules/websites/default.nix2
5 files changed, 13 insertions, 13 deletions
diff --git a/nixops/modules/certificates.nix b/nixops/modules/certificates.nix
index 9a9974e..72896fd 100644
--- a/nixops/modules/certificates.nix
+++ b/nixops/modules/certificates.nix
@@ -3,7 +3,7 @@
3 options.services.myCertificates = { 3 options.services.myCertificates = {
4 certConfig = lib.mkOption { 4 certConfig = lib.mkOption {
5 default = { 5 default = {
6 webroot = "/var/lib/acme/acme-challenge"; 6 webroot = "${config.security.acme.directory}/acme-challenge";
7 email = "ismael@bouya.org"; 7 email = "ismael@bouya.org";
8 postRun = '' 8 postRun = ''
9 systemctl reload httpdTools.service httpdInte.service httpdProd.service 9 systemctl reload httpdTools.service httpdInte.service httpdProd.service
@@ -29,14 +29,14 @@
29 systemd.services = lib.attrsets.mapAttrs' (k: v: 29 systemd.services = lib.attrsets.mapAttrs' (k: v:
30 lib.attrsets.nameValuePair "acme-selfsigned-${k}" (lib.mkBefore { script = 30 lib.attrsets.nameValuePair "acme-selfsigned-${k}" (lib.mkBefore { script =
31 (lib.optionalString (builtins.elem "cert.pem" v.plugins) '' 31 (lib.optionalString (builtins.elem "cert.pem" v.plugins) ''
32 cp $workdir/server.crt /var/lib/acme/${k}/cert.pem 32 cp $workdir/server.crt ${config.security.acme.directory}/${k}/cert.pem
33 chown '${v.user}:${v.group}' /var/lib/acme/${k}/cert.pem 33 chown '${v.user}:${v.group}' ${config.security.acme.directory}/${k}/cert.pem
34 chmod ${if v.allowKeysForGroup then "750" else "700"} /var/lib/acme/${k}/cert.pem 34 chmod ${if v.allowKeysForGroup then "750" else "700"} ${config.security.acme.directory}/${k}/cert.pem
35 '') + 35 '') +
36 (lib.optionalString (builtins.elem "chain.pem" v.plugins) '' 36 (lib.optionalString (builtins.elem "chain.pem" v.plugins) ''
37 cp $workdir/ca.crt /var/lib/acme/${k}/chain.pem 37 cp $workdir/ca.crt ${config.security.acme.directory}/${k}/chain.pem
38 chown '${v.user}:${v.group}' /var/lib/acme/${k}/chain.pem 38 chown '${v.user}:${v.group}' ${config.security.acme.directory}/${k}/chain.pem
39 chmod ${if v.allowKeysForGroup then "750" else "700"} /var/lib/acme/${k}/chain.pem 39 chmod ${if v.allowKeysForGroup then "750" else "700"} ${config.security.acme.directory}/${k}/chain.pem
40 '') 40 '')
41 ; }) 41 ; })
42 ) config.security.acme.certs // { 42 ) config.security.acme.certs // {
diff --git a/nixops/modules/ftp.nix b/nixops/modules/ftp.nix
index 871e9ef..842d2d6 100644
--- a/nixops/modules/ftp.nix
+++ b/nixops/modules/ftp.nix
@@ -102,7 +102,7 @@
102 MaxDiskUsage 99 102 MaxDiskUsage 99
103 CustomerProof yes 103 CustomerProof yes
104 TLS 1 104 TLS 1
105 CertFile /var/lib/acme/ftp/full.pem 105 CertFile ${config.security.acme.directory}/ftp/full.pem
106 ''; 106 '';
107 in { 107 in {
108 description = "Pure-FTPd server"; 108 description = "Pure-FTPd server";
diff --git a/nixops/modules/irc.nix b/nixops/modules/irc.nix
index a4f6f93..363bfef 100644
--- a/nixops/modules/irc.nix
+++ b/nixops/modules/irc.nix
@@ -40,7 +40,7 @@
40 bitlbee = { 40 bitlbee = {
41 accept = 6697; 41 accept = 6697;
42 connect = 6667; 42 connect = 6667;
43 cert = "/var/lib/acme/irc/full.pem"; 43 cert = "${config.security.acme.directory}/irc/full.pem";
44 }; 44 };
45 }; 45 };
46 }; 46 };
diff --git a/nixops/modules/task/default.nix b/nixops/modules/task/default.nix
index 426aa68..e1c933f 100644
--- a/nixops/modules/task/default.nix
+++ b/nixops/modules/task/default.nix
@@ -236,9 +236,9 @@ in {
236 inherit fqdn; 236 inherit fqdn;
237 listenHost = "::"; 237 listenHost = "::";
238 pki.manual.ca.cert = "${server_vardir}/keys/ca.cert"; 238 pki.manual.ca.cert = "${server_vardir}/keys/ca.cert";
239 pki.manual.server.cert = "/var/lib/acme/task/fullchain.pem"; 239 pki.manual.server.cert = "${config.security.acme.directory}/task/fullchain.pem";
240 pki.manual.server.crl = "/var/lib/acme/task/invalid.crl"; 240 pki.manual.server.crl = "${config.security.acme.directory}/task/invalid.crl";
241 pki.manual.server.key = "/var/lib/acme/task/key.pem"; 241 pki.manual.server.key = "${config.security.acme.directory}/task/key.pem";
242 requestLimit = 104857600; 242 requestLimit = 104857600;
243 }; 243 };
244 244
diff --git a/nixops/modules/websites/default.nix b/nixops/modules/websites/default.nix
index 5b839af..432ad3c 100644
--- a/nixops/modules/websites/default.nix
+++ b/nixops/modules/websites/default.nix
@@ -179,7 +179,7 @@ in
179 179
180 system.activationScripts = { 180 system.activationScripts = {
181 httpd = '' 181 httpd = ''
182 install -d -m 0755 /var/lib/acme/acme-challenge 182 install -d -m 0755 ${config.security.acme.directory}/acme-challenge
183 install -d -m 0750 -o wwwrun -g wwwrun /var/lib/php/sessions 183 install -d -m 0750 -o wwwrun -g wwwrun /var/lib/php/sessions
184 install -d -m 0750 -o wwwrun -g wwwrun /var/lib/php/sessions/adminer 184 install -d -m 0750 -o wwwrun -g wwwrun /var/lib/php/sessions/adminer
185 install -d -m 0750 -o wwwrun -g wwwrun /var/lib/php/tmp/adminer 185 install -d -m 0750 -o wwwrun -g wwwrun /var/lib/php/tmp/adminer