From 017cb76f3355369a57cee7e851e013fbe7b265b7 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Isma=C3=ABl=20Bouya?= Date: Mon, 13 May 2019 01:34:11 +0200 Subject: Pre-generate certificates with acme Fixes https://git.immae.eu/mantisbt/view.php?id=81 --- nixops/modules/certificates.nix | 22 ++++++++++++++++++++++ 1 file changed, 22 insertions(+) (limited to 'nixops') diff --git a/nixops/modules/certificates.nix b/nixops/modules/certificates.nix index bfad4e1..08f84fd 100644 --- a/nixops/modules/certificates.nix +++ b/nixops/modules/certificates.nix @@ -22,5 +22,27 @@ domain = "eldiron.immae.eu"; }; }; + + systemd.services = lib.attrsets.mapAttrs' (k: v: + lib.attrsets.nameValuePair "acme-selfsigned-${k}" (lib.mkBefore { script = + (lib.optionalString (builtins.elem "cert.pem" v.plugins) '' + cp $workdir/server.crt /var/lib/acme/${k}/cert.pem + chown '${v.user}:${v.group}' /var/lib/acme/${k}/cert.pem + chmod ${if v.allowKeysForGroup then "750" else "700"} /var/lib/acme/${k}/cert.pem + '') + + (lib.optionalString (builtins.elem "chain.pem" v.plugins) '' + cp $workdir/ca.crt /var/lib/acme/${k}/chain.pem + chown '${v.user}:${v.group}' /var/lib/acme/${k}/chain.pem + chmod ${if v.allowKeysForGroup then "750" else "700"} /var/lib/acme/${k}/chain.pem + '') + ; }) + ) config.security.acme.certs // { + httpdProd.after = [ "acme-selfsigned-certificates.target" ]; + httpdProd.wants = [ "acme-selfsigned-certificates.target" ]; + httpdTools.after = [ "acme-selfsigned-certificates.target" ]; + httpdTools.wants = [ "acme-selfsigned-certificates.target" ]; + httpdInte.after = [ "acme-selfsigned-certificates.target" ]; + httpdInte.wants = [ "acme-selfsigned-certificates.target" ]; + }; }; } -- cgit v1.2.3