sid/sid.ovh
1
0
Fork 0
Code Issues 3 Pull requests 2 Projects Releases Packages Wiki Activity Actions

ca store paths do not work. add well-knowns for acme challenges
All checks were successful
Flake check / flake-check (pull_request) Successful in 19s
Details
Build hosts / build-hosts (pull_request) Successful in 21s
Details

Browse source
This commit is contained in:
sid 2026-04-19 03:56:34 +02:00
parent bd2ba125e5
commit bc6ba27415
5 changed files with 30 additions and 28 deletions
Download patch file Download diff file Expand all files Collapse all files

32
hosts/sid/services/nginx.nix
View file

@ -19,6 +19,11 @@ in
enable = true;
openFirewall = true;
forceSSL = ssl;
virtualHosts."${constants.ca-fqdn}" = {
locations."/.well-known/acme-challenge/" = {
root = "/var/lib/acme/acme-challenge";
};
};
virtualHosts."${constants.services.docs.fqdn}" = mkVirtualHost {
inherit ssl;
address = constants.hosts.rx4.ip;
@ -34,10 +39,10 @@ in
address = constants.hosts.rx4.ip;
port = constants.services.miniflux.port;
};
virtualHosts."${constants.services.netdata.fqdn}" = mkVirtualHost {
inherit ssl;
port = constants.services.netdata.port;
};
# virtualHosts."${constants.services.netdata.fqdn}" = mkVirtualHost {
# inherit ssl;
# port = constants.services.netdata.port;
# };
virtualHosts."${constants.services.open-webui-oci.fqdn}" = mkVirtualHost {
inherit ssl;
address = constants.hosts.rx4.ip;
@ -58,15 +63,20 @@ in
virtualHosts."${constants.services.vaultwarden.fqdn}" = {
useACMEHost = "sid-internal";
forceSSL = ssl;
locations."/" = {
proxyPass = "http://${constants.hosts.rx4.ip}:${toString constants.services.vaultwarden.port}";
locations = {
"/" = {
proxyPass = "http://${constants.hosts.rx4.ip}:${toString constants.services.vaultwarden.port}";
};
"/.well-known/acme-challenge/" = {
root = "/var/lib/acme/acme-challenge";
};
};
};
virtualHosts."${constants.services.webdav.fqdn}" = mkVirtualHost {
inherit ssl;
address = constants.hosts.rx4.ip;
port = constants.services.webdav.port;
};
# virtualHosts."${constants.services.webdav.fqdn}" = mkVirtualHost {
# inherit ssl;
# address = constants.hosts.rx4.ip;
# port = constants.services.webdav.port;
# };
# FIXME
# virtualHosts."print.sid.ovh" = {
# enableACME = true;

12
hosts/sid/services/step-ca.nix
View file

@ -17,8 +17,12 @@ in
intermediatePasswordFile = config.sops.secrets."step-ca/password".path;
# nix-shell -p step-cli --run "step ca init"
settings = {
root = ../../../certs/root_ca.crt;
crt = ../../../certs/intermediate_ca.crt;
# FIXME: nix-store paths do not work
# root = ../../../certs/root_ca.crt;
# crt = ../../../certs/intermediate_ca.crt;
# FIXME: not reproducible
root = "/var/lib/step-ca/certs/root_ca.crt";
crt = "/var/lib/step-ca/certs/intermediate_ca.crt";
key = config.sops.secrets."step-ca/intermediate-key".path;
dnsNames = [
constants.ca-fqdn
@ -75,9 +79,9 @@ in
certs."sid-internal" = {
domain = constants.intranet;
extraDomainNames = [
constants.services.netdata.fqdn
# constants.services.netdata.fqdn
constants.services.vaultwarden.fqdn
constants.services.webdav.fqdn
# constants.services.webdav.fqdn
];
server = "https://${constants.ca-fqdn}:${toString cfg.port}/acme/acme/directory";
group = "nginx";