Initial commit

letsencrypt/acme.nix

@@ -0,0 +1,22 @@
+{ config, pkgs, ... }:
+let
+  cfg = config.services.userdata;
+in
+{
+  users.groups.acmerecievers = {
+    members = [ "nginx" "dovecot2" "postfix" "virtualMail" "ocserv" ];
+  };
+  security.acme = {
+    acceptTerms = true;
+    email = "${cfg.username}@${cfg.domain}";
+    certs = {
+      "${cfg.domain}" = {
+        domain = "*.${cfg.domain}";
+        extraDomainNames = [ "${cfg.domain}" ];
+        group = "acmerecievers";
+        dnsProvider = "cloudflare";
+        credentialsFile = "/var/cloudflareCredentials.ini";
+      };
+    };
+  };
+}

letsencrypt/resolve.nix

@@ -0,0 +1,22 @@
+{ config, pkgs, ... }:
+let
+  domain = config.services.userdata.domain;
+in
+{
+  systemd = {
+    services = {
+      "acme-${domain}" = {
+        serviceConfig = {
+          StartLimitBurst = 5;
+          StartLimitIntervalSec = 5;
+          Restart = "on-failure";
+        };
+      };
+      "nginx-config-reload" = {
+        serviceConfig = {
+          After = [ "acme-${domain}.service" ];
+        };
+      };
+    };
+  };
+}