nixos-config

commit 3d9f2dd7bc188113462dae00f6c502cc4f3ced18
parent abe0ef21cf91e3a638f899d5091e82bc4c4fdee5
Author: vin <vin@vineetk.net>
Date:   Sun,  2 Mar 2025 02:23:42 -0500

saklas: enable nginx and acme

Diffstat:
M
hosts/saklas/default.nix
 | 
17
++++++++++++++---
M
hosts/saklas/mail.nix
 | 
1
+

2 files changed, 15 insertions(+), 3 deletions(-)
diff --git a/hosts/saklas/default.nix b/hosts/saklas/default.nix
@@ -70,8 +70,19 @@
   security = {
     acme = {
       acceptTerms = true;
-      defaults.email = "me@vineetk.net";
-      defaults.server = "https://acme-v02.api.letsencrypt.org/directory";
+
+      defaults = {
+        credentialFiles."HETZNER_API_KEY_FILE" = "/run/secrets/hetzner-dns-api";
+        dnsProvider = "hetzner";
+        email = "acme@vineetk.net";
+        server = "https://acme-v02.api.letsencrypt.org/directory";
+      };
+
+      certs = {
+        "vinbiz.ca".extraDomainNames = [ "*.vinbiz.ca" ];
+        "vineetk.net".extraDomainNames = [ "*.vineetk.net" ];
+        "13f0.net".extraDomainNames = [ "*.13f0.net" ];
+      };
     };
 
     # I prefer doas over sudo for simplicity
@@ -90,7 +101,7 @@
   services = {
     # web server and reverse proxy
     nginx = {
-      enable = false;
+      enable = true;
 
       recommendedGzipSettings = true;
       recommendedOptimisation = true;
diff --git a/hosts/saklas/mail.nix b/hosts/saklas/mail.nix
@@ -54,6 +54,7 @@ if address :matches [ "to", "cc" ] "tuhs@tuhs.org" {
       "suren@vinbiz.ca".hashedPassword = "$2b$05$.VTHKaBu0JQf2MpLNa7GXeliyZxOdXms59VslMmEjnu.IOzjVgHzy";
     };
 
+    acmeCertificateName = "vineetk.net";
     certificateScheme = "acme";
   };
 }