saklas: enable nginx and acme

2 files changed, 15 insertions, 3 deletions

diff --git a/hosts/saklas/default.nix b/hosts/saklas/default.nix
index e8203ea..4ed76ec 100644
--- a/hosts/saklas/default.nix
+++ b/hosts/saklas/default.nix
@@ -70,8 +70,19 @@
   security = {
     acme = {
       acceptTerms = true;
-      defaults.email = "me@vineetk.net";
-      defaults.server = "https://acme-v02.api.letsencrypt.org/directory";
+
+      defaults = {
+        credentialFiles."HETZNER_API_KEY_FILE" = "/run/secrets/hetzner-dns-api";
+        dnsProvider = "hetzner";
+        email = "acme@vineetk.net";
+        server = "https://acme-v02.api.letsencrypt.org/directory";
+      };
+
+      certs = {
+        "vinbiz.ca".extraDomainNames = [ "*.vinbiz.ca" ];
+        "vineetk.net".extraDomainNames = [ "*.vineetk.net" ];
+        "13f0.net".extraDomainNames = [ "*.13f0.net" ];
+      };
     };
 
     # I prefer doas over sudo for simplicity
@@ -90,7 +101,7 @@
   services = {
     # web server and reverse proxy
     nginx = {
-      enable = false;
+      enable = true;
 
       recommendedGzipSettings = true;
       recommendedOptimisation = true;
diff --git a/hosts/saklas/mail.nix b/hosts/saklas/mail.nix
index 7593b2a..a43f194 100644
--- a/hosts/saklas/mail.nix
+++ b/hosts/saklas/mail.nix
@@ -54,6 +54,7 @@ if address :matches [ "to", "cc" ] "tuhs@tuhs.org" {
       "suren@vinbiz.ca".hashedPassword = "$2b$05$.VTHKaBu0JQf2MpLNa7GXeliyZxOdXms59VslMmEjnu.IOzjVgHzy";
     };
 
+    acmeCertificateName = "vineetk.net";
     certificateScheme = "acme";
   };
 }