tlaternet/tlaternet-server
1
0
Fork 0
Code Issues 9 Pull requests Releases Activity

WIP: acme: Switch to a wildcard certificate

Browse source
This commit is contained in:
Tristan Daniël Maat 2024-04-16 01:08:13 +02:00
parent 8f178f776e
commit 45d2502125
Signed by: tlater
GPG key ID: 49670FD774E43268
8 changed files with 13 additions and 7 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

6
configuration/nginx.nix
View file

@ -49,6 +49,12 @@
security.acme = { security.acme = {
defaults.email = "tm@tlater.net"; defaults.email = "tm@tlater.net";
acceptTerms = true; acceptTerms = true;
certs."tlater.net" = {
extraDomainNames = ["*.tlater.net"];
dnsProvider = "hetzner";
group = "nginx";
};
}; };
services.backups.acme = { services.backups.acme = {

2
configuration/services/afvalcalendar.nix
View file

@ -44,7 +44,7 @@
services.nginx.virtualHosts."afvalcalendar.${config.services.nginx.domain}" = { services.nginx.virtualHosts."afvalcalendar.${config.services.nginx.domain}" = {
forceSSL = true; forceSSL = true;
enableACME = true; useACMEHost = "tlater.net";
enableHSTS = true; enableHSTS = true;
root = "/srv/afvalcalendar"; root = "/srv/afvalcalendar";

2
configuration/services/conduit.nix
View file

@ -178,7 +178,7 @@ in {
}; };
services.nginx.virtualHosts."${domain}" = { services.nginx.virtualHosts."${domain}" = {
enableACME = true; useACMEHost = "tlater.net";
listen = [ listen = [
{ {

2
configuration/services/foundryvtt.nix
View file

@ -24,7 +24,7 @@ in {
inherit (config.services.foundryvtt) port; inherit (config.services.foundryvtt) port;
in { in {
forceSSL = true; forceSSL = true;
enableACME = true; useACMEHost = "tlater.net";
enableHSTS = true; enableHSTS = true;
locations."/" = { locations."/" = {

2
configuration/services/gitea.nix
View file

@ -41,7 +41,7 @@ in {
httpPort = config.services.forgejo.settings.server.HTTP_PORT; httpPort = config.services.forgejo.settings.server.HTTP_PORT;
in { in {
forceSSL = true; forceSSL = true;
enableACME = true; useACMEHost = "tlater.net";
enableHSTS = true; enableHSTS = true;
locations."/".proxyPass = "http://${httpAddress}:${toString httpPort}"; locations."/".proxyPass = "http://${httpAddress}:${toString httpPort}";

2
configuration/services/metrics/grafana.nix
View file

@ -38,7 +38,7 @@ in {
services.nginx.virtualHosts."${domain}" = { services.nginx.virtualHosts."${domain}" = {
forceSSL = true; forceSSL = true;
enableACME = true; useACMEHost = "tlater.net";
enableHSTS = true; enableHSTS = true;
locations."/".proxyPass = "http://localhost:${toString config.services.grafana.settings.server.http_port}"; locations."/".proxyPass = "http://localhost:${toString config.services.grafana.settings.server.http_port}";
}; };

2
configuration/services/nextcloud.nix
View file

@ -45,7 +45,7 @@ in {
# Set up SSL # Set up SSL
services.nginx.virtualHosts."${hostName}" = { services.nginx.virtualHosts."${hostName}" = {
forceSSL = true; forceSSL = true;
enableACME = true; useACMEHost = "tlater.net";
# The upstream module already adds HSTS # The upstream module already adds HSTS
}; };

2
configuration/services/webserver.nix
View file

@ -16,7 +16,7 @@ in {
serverAliases = ["www.${domain}"]; serverAliases = ["www.${domain}"];
forceSSL = true; forceSSL = true;
enableACME = true; useACMEHost = "tlater.net";
enableHSTS = true; enableHSTS = true;
locations."/".proxyPass = "http://${addr}:${toString port}"; locations."/".proxyPass = "http://${addr}:${toString port}";