acme: Don't attempt to get certs if the domain is wrong

This commit is contained in:
Tristan Daniël Maat 2024-03-03 01:06:52 +01:00
parent ddda6f534b
commit 1c6e7ec106
Signed by: tlater
GPG key ID: 49670FD774E43268
4 changed files with 21 additions and 5 deletions

View file

@ -137,7 +137,6 @@
recommendedGzipSettings = true;
recommendedProxySettings = true;
clientMaxBodySize = "10G";
domain = "tlater.net";
statusPage = true; # For metrics, should be accessible only from localhost

View file

@ -6,6 +6,8 @@
# Required for the lish console
boot.kernelParams = ["console=ttyS0,19200n8"];
services.nginx.domain = "tlater.net";
boot.loader = {
# Timeout to allow lish to connect
timeout = 10;

View file

@ -7,7 +7,7 @@
networking.hostName = "testvm";
# Sets the base domain for nginx to localhost so that we
# can easily test locally with the VM.
services.nginx.domain = lib.mkOverride 99 "localhost";
services.nginx.domain = "localhost";
# Use the staging secrets
sops.defaultSopsFile = lib.mkOverride 99 ../../keys/staging.yaml;

View file

@ -1,8 +1,23 @@
{lib, ...}: let
inherit (lib) mkOption types;
in {
{
pkgs,
config,
lib,
...
}: {
options.services.nginx.domain = lib.mkOption {
type = lib.types.str;
description = "The base domain name to append to virtual domain names";
};
config = {
# Don't attempt to run acme if the domain name is not tlater.net
systemd.services = let
confirm = ''[[ "tlater.net" = ${config.services.nginx.domain} ]]'';
in
lib.mapAttrs' (cert: _:
lib.nameValuePair "acme-${cert}" {
serviceConfig.ExecCondition = ''${pkgs.runtimeShell} -c '${confirm}' '';
})
config.security.acme.certs;
};
}