From 27492ea730c7f9131150a29eb5df5b7abec698a4 Mon Sep 17 00:00:00 2001 From: sid Date: Sun, 17 May 2026 23:01:56 +0200 Subject: [PATCH] rm step-ca and coredns --- constants.nix | 2 +- hosts/rx4/services/nginx.nix | 19 ++++++ hosts/rx4/services/vaultwarden.nix | 21 ++---- hosts/sid/services/coredns.nix | 31 --------- hosts/sid/services/default.nix | 3 - hosts/sid/services/headscale.nix | 5 -- hosts/sid/services/step-ca.nix | 105 ----------------------------- 7 files changed, 24 insertions(+), 162 deletions(-) delete mode 100644 hosts/sid/services/coredns.nix delete mode 100644 hosts/sid/services/step-ca.nix diff --git a/constants.nix b/constants.nix index 91b8456..e8de9ad 100644 --- a/constants.nix +++ b/constants.nix @@ -30,7 +30,7 @@ rec { port = 8085; }; netdata = { - fqdn = "mon." + domain; + # fqdn = "mon." + domain; port = 19999; }; open-webui-oci = { diff --git a/hosts/rx4/services/nginx.nix b/hosts/rx4/services/nginx.nix index c4c24af..cae8e31 100644 --- a/hosts/rx4/services/nginx.nix +++ b/hosts/rx4/services/nginx.nix @@ -7,6 +7,8 @@ let cfg = config.services.nginx; + + inherit (constants) domain; in { imports = [ @@ -34,4 +36,21 @@ in }; }; }; + + security.acme = { + acceptTerms = true; + defaults = { + email = "admin@${domain}"; + dnsProvider = "hetzner"; + credentialFiles = { + HETZNER_API_TOKEN_FILE = config.sops.secrets.hetzner-api-key.path; + }; + }; + }; + + sops.secrets.hetzner-api-key = { + mode = "0400"; + owner = "acme"; + group = "acme"; + }; } diff --git a/hosts/rx4/services/vaultwarden.nix b/hosts/rx4/services/vaultwarden.nix index eed5712..cffaeae 100644 --- a/hosts/rx4/services/vaultwarden.nix +++ b/hosts/rx4/services/vaultwarden.nix @@ -62,18 +62,10 @@ in }; }; - security.acme = { - acceptTerms = true; - defaults.email = "admin@${domain}"; - certs."pw-custom" = { - domain = fqdn; - dnsProvider = "hetzner"; - dnsResolver = "1.1.1.1:53"; - credentialFiles = { - HETZNER_API_TOKEN_FILE = config.sops.secrets.hetzner-api-key.path; - }; - group = "nginx"; - }; + security.acme.certs."pw-custom" = { + domain = fqdn; + postRun = "systemctl restart vaultwarden.service"; + group = "nginx"; }; sops = @@ -90,11 +82,6 @@ in "vaultwarden/smtp-password" = { inherit owner group mode; }; - hetzner-api-key = { - inherit mode; - owner = "acme"; - group = "acme"; - }; }; templates = { "vaultwarden/env-file" = { diff --git a/hosts/sid/services/coredns.nix b/hosts/sid/services/coredns.nix deleted file mode 100644 index b7e2f37..0000000 --- a/hosts/sid/services/coredns.nix +++ /dev/null @@ -1,31 +0,0 @@ -{ constants, ... }: - -{ - services.resolved.enable = false; - networking.resolvconf.enable = false; - - networking.nameservers = [ "127.0.0.1" ]; - - services.coredns = { - enable = true; - config = with constants; '' - .:53 { - bind 0.0.0.0 - hosts { - ${hosts.sid.ip} ${ca-fqdn} - - ${hosts.sid.ip} ${services.netdata.fqdn} - - fallthrough - } - forward . 1.1.1.1 8.8.8.8 - cache 30 - log - errors - } - ''; - }; - - networking.firewall.allowedUDPPorts = [ 53 ]; - networking.firewall.allowedTCPPorts = [ 53 ]; -} diff --git a/hosts/sid/services/default.nix b/hosts/sid/services/default.nix index 9baf6fb..7ca9678 100644 --- a/hosts/sid/services/default.nix +++ b/hosts/sid/services/default.nix @@ -17,8 +17,5 @@ ./nginx.nix ./radicale.nix ./rss-bridge.nix - - # ./coredns.nix - # ./step-ca.nix ]; } diff --git a/hosts/sid/services/headscale.nix b/hosts/sid/services/headscale.nix index b9492db..0d4a03f 100644 --- a/hosts/sid/services/headscale.nix +++ b/hosts/sid/services/headscale.nix @@ -31,11 +31,6 @@ type = "A"; value = constants.hosts.rx4.ip; } - { - name = constants.services.netdata.fqdn; - type = "A"; - value = constants.hosts.sid.ip; - } ]; }; } diff --git a/hosts/sid/services/step-ca.nix b/hosts/sid/services/step-ca.nix deleted file mode 100644 index e2570c9..0000000 --- a/hosts/sid/services/step-ca.nix +++ /dev/null @@ -1,105 +0,0 @@ -{ - constants, - config, - pkgs, - ... -}: - -let - cfg = config.services.step-ca; -in -{ - services.step-ca = { - enable = true; - address = "0.0.0.0"; - port = 8443; - openFirewall = true; - intermediatePasswordFile = config.sops.secrets."step-ca/password".path; - # nix-shell -p step-cli --run "step ca init" - settings = { - # FIXME: nix-store paths do not work - # root = ../../../certs/root_ca.crt; - # crt = ../../../certs/intermediate_ca.crt; - # FIXME: not reproducible - root = "/var/lib/step-ca/certs/root_ca.crt"; - crt = "/var/lib/step-ca/certs/intermediate_ca.crt"; - key = config.sops.secrets."step-ca/intermediate-key".path; - dnsNames = [ - constants.ca-fqdn - constants.hosts.sid.ip - ]; - logger = { - format = "text"; - }; - db = { - type = "badgerv2"; - dataSource = "/var/lib/step-ca/db"; - }; - authority = { - provisioners = [ - { - type = "ACME"; - name = "acme"; - } - { - type = "JWK"; - name = "sid@sid.ovh"; - key = { - use = "sig"; - kty = "EC"; - kid = "w3fV4U-frlyTnBMg4yNYrLsn8_mY98H8HthoscpoVrg"; - crv = "P-256"; - alg = "ES256"; - x = "KZCDecn4sb87T3UO6JsIzJVtr4Aa0UcYzYDNBUM6F7M"; - y = "CbGHn9tXQbV0Ur2VuXITLnWgfxCRmKEoUdMUmrP9Qkw"; - }; - encryptedKey = "eyJhbGciOiJQQkVTMi1IUzI1NitBMTI4S1ciLCJjdHkiOiJqd2sranNvbiIsImVuYyI6IkEyNTZHQ00iLCJwMmMiOjYwMDAwMCwicDJzIjoiZS1MUDhDYlE4dzVuMF9nUGhXOWtGdyJ9.rgsqo58rJFWaociSqiPg3E1alAeqoHWubJi4n2uoUFYp3YTWaYZzqA.6P6oimHsKGdCWruo.fNaDr50IXCtCe7W7VIXuS3rlfin_R0nogNpIJ9C6szYg8k10UylircUs14Zl1EHQ9lFeJovb1y1uljzBajMGkOAGlMvashrphVkXiSxHWKDhzbrItJx3qChLtSLJJtXiXPbJQKCAeBjztqPuTw6dI4Z6IR9---kiTvzF6I9KE8afGFlMSubGjr9FnqgiOb2JiZuTfcBGDx78puxdWzUrEEVlliHdv2agbKhY0b13x-obaTIWwlqLFbasv7kPneJ8Ggp7IHHr5uDcUrqVKkTfBrD0lelXm6SwJTHGMkty6inlwSflT9mxvkNq7OGV9triPQc8AGVv0c7t7dHoX_E.tSjJqttCS6zLI_-7zPdXNQ"; - } - ]; - }; - tls = { - cipherSuites = [ - "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256" - "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256" - ]; - renegotiation = false; - }; - }; - }; - - environment.systemPackages = [ - pkgs.step-cli - ]; - - systemd.tmpfiles.rules = [ - "d /var/lib/acme/acme-challenge 0755 acme nginx" - ]; - - security.acme = { - certs."sid-internal" = { - # domain = constants.intranet; - domain = constants.services.netdata.fqdn; - extraDomainNames = [ - ]; - server = "https://${constants.ca-fqdn}:${toString cfg.port}/acme/acme/directory"; - group = "nginx"; - }; - }; - - sops = - let - owner = "step-ca"; - group = "step-ca"; - mode = "0400"; - in - { - secrets = { - "step-ca/password" = { - inherit owner group mode; - }; - "step-ca/intermediate-key" = { - inherit owner group mode; - }; - }; - }; -} -- 2.51.2