|
13 | 13 | description = '' |
14 | 14 | Where the webroot of the HTTP vhost is located. |
15 | 15 | <filename>.well-known/acme-challenge/</filename> directory |
16 | | - will be created automatically if it doesn't exist. |
| 16 | + will be created below the webroot if it doesn't exist. |
17 | 17 | <literal>http://example.org/.well-known/acme-challenge/</literal> must also |
18 | 18 | be available (notice unencrypted HTTP). |
19 | 19 | ''; |
|
46 | 46 | allowKeysForGroup = mkOption { |
47 | 47 | type = types.bool; |
48 | 48 | default = false; |
49 | | - description = "Give read permissions to the specified group to read SSL private certificates."; |
| 49 | + description = '' |
| 50 | + Give read permissions to the specified group |
| 51 | + (<option>security.acme.group</option>) to read SSL private certificates. |
| 52 | + ''; |
50 | 53 | }; |
51 | 54 |
|
52 | 55 | postRun = mkOption { |
|
65 | 68 | "cert.der" "cert.pem" "chain.pem" "external.sh" |
66 | 69 | "fullchain.pem" "full.pem" "key.der" "key.pem" "account_key.json" |
67 | 70 | ]); |
68 | | - default = [ "fullchain.pem" "key.pem" "account_key.json" ]; |
| 71 | + default = [ "fullchain.pem" "full.pem" "key.pem" "account_key.json" ]; |
69 | 72 | description = '' |
70 | 73 | Plugins to enable. With default settings simp_le will |
71 | | - store public certificate bundle in <filename>fullchain.pem</filename> |
72 | | - and private key in <filename>key.pem</filename> in its state directory. |
| 74 | + store public certificate bundle in <filename>fullchain.pem</filename>, |
| 75 | + private key in <filename>key.pem</filename> and those two previous |
| 76 | + files combined in <filename>full.pem</filename> in its state directory. |
73 | 77 | ''; |
74 | 78 | }; |
75 | 79 |
|
76 | 80 | extraDomains = mkOption { |
77 | 81 | type = types.attrsOf (types.nullOr types.str); |
78 | 82 | default = {}; |
79 | | - example = { |
80 | | - "example.org" = "/srv/http/nginx"; |
81 | | - "mydomain.org" = null; |
82 | | - }; |
| 83 | + example = literalExample '' |
| 84 | + { |
| 85 | + "example.org" = "/srv/http/nginx"; |
| 86 | + "mydomain.org" = null; |
| 87 | + } |
| 88 | + ''; |
83 | 89 | description = '' |
84 | 90 | Extra domain names for which certificates are to be issued, with their |
85 | 91 | own server roots if needed. |
|
139 | 145 | description = '' |
140 | 146 | Attribute set of certificates to get signed and renewed. |
141 | 147 | ''; |
142 | | - example = { |
143 | | - "example.com" = { |
144 | | - webroot = "/var/www/challenges/"; |
145 | | - email = "foo@example.com"; |
146 | | - extraDomains = { "www.example.com" = null; "foo.example.com" = "/var/www/foo/"; }; |
147 | | - }; |
148 | | - "bar.example.com" = { |
149 | | - webroot = "/var/www/challenges/"; |
150 | | - email = "bar@example.com"; |
151 | | - }; |
152 | | - }; |
| 148 | + example = literalExample '' |
| 149 | + { |
| 150 | + "example.com" = { |
| 151 | + webroot = "/var/www/challenges/"; |
| 152 | + email = "foo@example.com"; |
| 153 | + extraDomains = { "www.example.com" = null; "foo.example.com" = "/var/www/foo/"; }; |
| 154 | + }; |
| 155 | + "bar.example.com" = { |
| 156 | + webroot = "/var/www/challenges/"; |
| 157 | + email = "bar@example.com"; |
| 158 | + }; |
| 159 | + } |
| 160 | + ''; |
153 | 161 | }; |
154 | 162 | }; |
155 | 163 | }; |
|
238 | 246 | mv $workdir/server.key ${cpath}/key.pem |
239 | 247 | mv $workdir/server.crt ${cpath}/fullchain.pem |
240 | 248 |
|
| 249 | + # Create full.pem for e.g. lighttpd (same format as "simp_le ... -f full.pem" creates) |
| 250 | + cat "${cpath}/key.pem" "${cpath}/fullchain.pem" > "${cpath}/full.pem" |
| 251 | +
|
241 | 252 | # Clean up working directory |
242 | 253 | rm $workdir/server.csr |
243 | 254 | rm $workdir/server.pass.key |
|
247 | 258 | chown '${data.user}:${data.group}' '${cpath}/key.pem' |
248 | 259 | chmod ${rights} '${cpath}/fullchain.pem' |
249 | 260 | chown '${data.user}:${data.group}' '${cpath}/fullchain.pem' |
| 261 | + chmod ${rights} '${cpath}/full.pem' |
| 262 | + chown '${data.user}:${data.group}' '${cpath}/full.pem' |
250 | 263 | ''; |
251 | 264 | serviceConfig = { |
252 | 265 | Type = "oneshot"; |
|
275 | 288 | ) |
276 | 289 | ); |
277 | 290 | servicesAttr = listToAttrs services; |
278 | | - nginxAttr = { |
279 | | - nginx = { |
280 | | - after = [ "acme-selfsigned-certificates.target" ]; |
281 | | - wants = [ "acme-selfsigned-certificates.target" "acme-certificates.target" ]; |
282 | | - }; |
| 291 | + injectServiceDep = { |
| 292 | + after = [ "acme-selfsigned-certificates.target" ]; |
| 293 | + wants = [ "acme-selfsigned-certificates.target" "acme-certificates.target" ]; |
283 | 294 | }; |
284 | 295 | in |
285 | 296 | servicesAttr // |
286 | | - (if config.services.nginx.enable then nginxAttr else {}); |
| 297 | + (if config.services.nginx.enable then { nginx = injectServiceDep; } else {}) // |
| 298 | + (if config.services.lighttpd.enable then { lighttpd = injectServiceDep; } else {}); |
287 | 299 |
|
288 | 300 | systemd.timers = flip mapAttrs' cfg.certs (cert: data: nameValuePair |
289 | 301 | ("acme-${cert}") |
|
0 commit comments