nsd-acme
This commit is contained in:
parent
3e66f95668
commit
9a456192af
|
|
@ -70,6 +70,14 @@
|
|||
myData.ports.exporters.node
|
||||
];
|
||||
|
||||
nsd-acme = {
|
||||
enable = true;
|
||||
zones."grafana.jakstys.lt" = {
|
||||
accountKey = config.age.secrets.letsencrypt-account-key.path;
|
||||
staging = true;
|
||||
};
|
||||
};
|
||||
|
||||
deployerbot = {
|
||||
main = {
|
||||
enable = true;
|
||||
|
|
@ -172,36 +180,13 @@
|
|||
|
||||
nsd = {
|
||||
enable = true;
|
||||
remoteControl.enable = true;
|
||||
interfaces = ["0.0.0.0" "::"];
|
||||
zones = {
|
||||
"jakstys.lt.".data = myData.jakstysLTZone;
|
||||
};
|
||||
extraConfig = ''
|
||||
pattern:
|
||||
name: "acme"
|
||||
zonefile: "/var/lib/nsd/zones/%s."
|
||||
'';
|
||||
};
|
||||
};
|
||||
|
||||
systemd.services.nsd-control-setup = {
|
||||
requiredBy = ["nsd.service"];
|
||||
before = ["nsd.service"];
|
||||
unitConfig.ConditionPathExists = [
|
||||
"|!/etc/nsd/nsd_control.key"
|
||||
"|!/etc/nsd/nsd_control.pem"
|
||||
"|!/etc/nsd/nsd_server.key"
|
||||
"|!/etc/nsd/nsd_server.pem"
|
||||
];
|
||||
serviceConfig = {
|
||||
Type = "oneshot";
|
||||
UMask = 0077;
|
||||
};
|
||||
path = [pkgs.nsd pkgs.openssl];
|
||||
script = ''nsd-control-setup'';
|
||||
};
|
||||
|
||||
networking = {
|
||||
hostId = "f9117e1b";
|
||||
hostName = "vno1-oh2";
|
||||
|
|
|
|||
|
|
@ -7,6 +7,7 @@
|
|||
imports = [
|
||||
./deployerbot
|
||||
./friendlyport
|
||||
./nsd-acme
|
||||
./postfix
|
||||
./syncthing
|
||||
./zfsunlock
|
||||
|
|
|
|||
|
|
@ -0,0 +1,157 @@
|
|||
{
|
||||
config,
|
||||
lib,
|
||||
pkgs,
|
||||
...
|
||||
}: let
|
||||
mkHook = zone: let
|
||||
rc = config.services.nsd.remoteControl;
|
||||
fullZone = "_acme-endpoint.${zone}";
|
||||
nsdconf = ''"$RUNTIME_DIRECTORY"/nsd.conf'';
|
||||
in
|
||||
pkgs.writeShellScript "nsd-acme-hook" ''
|
||||
set -euo pipefail
|
||||
METHOD=$1
|
||||
TYPE=$2
|
||||
AUTH=$5
|
||||
NOW=$(date +%y%m%d%H%M)
|
||||
DIR="/var/lib/nsd/zones"
|
||||
|
||||
sed \
|
||||
-e "s~${rc.controlKeyFile}~$CREDENTIALS_DIRECTORY/nsd_control.key~" \
|
||||
-e "s~${rc.controlCertFile}~$CREDENTIALS_DIRECTORY/nsd_control.pem~" \
|
||||
-e "s~${rc.serverKeyFile}~$CREDENTIALS_DIRECTORY/nsd_server.key~" \
|
||||
-e "s~${rc.serverCertFile}~$CREDENTIALS_DIRECTORY/nsd_server.pem~" \
|
||||
/etc/nsd/nsd.conf > ${nsdconf}
|
||||
|
||||
[ "$TYPE" != "dns-01" ] && { echo "Skipping $TYPE"; exit 1; }
|
||||
|
||||
write_zone() {
|
||||
cat <<EOF
|
||||
\$ORIGIN ${fullZone}.
|
||||
\$TTL 60
|
||||
@ SOA ${fullZone}. motiejus.jakstys.lt. ($NOW 12h 2h 2w 1h)
|
||||
@ TXT $AUTH
|
||||
EOF
|
||||
}
|
||||
|
||||
cleanup() {
|
||||
nsd-control delzone ${fullZone}
|
||||
rm -f "$DIR/${fullZone}.acme"
|
||||
}
|
||||
|
||||
case "$METHOD" in
|
||||
begin)
|
||||
echo "Deleting previous ${fullZone} if exists ..."
|
||||
nsd-control -c ${nsdconf} delzone ${fullZone} || :
|
||||
write_zone > "$DIR/${fullZone}.acme"
|
||||
|
||||
echo "Activating ${fullZone}"
|
||||
nsd-control -c ${nsdconf} addzone ${fullZone} acme
|
||||
;;
|
||||
done)
|
||||
echo "ACME request successful, cleaning up"
|
||||
cleanup
|
||||
;;
|
||||
failed)
|
||||
echo "ACME request failed, cleaning up"
|
||||
cleanup
|
||||
;;
|
||||
esac
|
||||
'';
|
||||
in {
|
||||
options.mj.services.nsd-acme = with lib.types; {
|
||||
enable = lib.mkEnableOption "enable acme certs via nsd";
|
||||
|
||||
zones = lib.mkOption {
|
||||
default = {};
|
||||
type = attrsOf (submodule (
|
||||
{...}: {
|
||||
options = {
|
||||
accountKey = lib.mkOption {type = path;};
|
||||
days = lib.mkOption {
|
||||
type = int;
|
||||
default = 30;
|
||||
};
|
||||
staging = lib.mkOption {
|
||||
type = bool;
|
||||
default = false;
|
||||
};
|
||||
};
|
||||
}
|
||||
));
|
||||
};
|
||||
};
|
||||
|
||||
# TODO assert services.nsd.enable
|
||||
config = lib.mkIf config.mj.services.nsd-acme.enable {
|
||||
services.nsd.remoteControl.enable = true;
|
||||
services.nsd.extraConfig = ''
|
||||
pattern:
|
||||
name: "acme"
|
||||
zonefile: "/var/lib/nsd/zones/%s.acme"
|
||||
'';
|
||||
|
||||
systemd.services =
|
||||
{
|
||||
nsd-control-setup = {
|
||||
requiredBy = ["nsd.service"];
|
||||
before = ["nsd.service"];
|
||||
unitConfig.ConditionPathExists = let
|
||||
rc = config.services.nsd.remoteControl;
|
||||
in [
|
||||
"|!${rc.controlKeyFile}"
|
||||
"|!${rc.controlCertFile}"
|
||||
"|!${rc.serverKeyFile}"
|
||||
"|!${rc.serverCertFile}"
|
||||
];
|
||||
serviceConfig = {
|
||||
Type = "oneshot";
|
||||
UMask = 0077;
|
||||
ExecStart = "${pkgs.nsd}/bin/nsd-control-setup";
|
||||
};
|
||||
path = [pkgs.openssl];
|
||||
};
|
||||
}
|
||||
// lib.mapAttrs'
|
||||
(
|
||||
zone: cfg: let
|
||||
sanitized = lib.strings.sanitizeDerivationName zone;
|
||||
in
|
||||
lib.nameValuePair "nsd-acme-${sanitized}" {
|
||||
description = "dns-01 acme update for ${zone}";
|
||||
path = [pkgs.openssh pkgs.nsd];
|
||||
preStart = ''
|
||||
mkdir -p "$STATE_DIRECTORY/private"
|
||||
ln -sf "$CREDENTIALS_DIRECTORY/letsenctypt-account.key" \
|
||||
"$STATE_DIRECTORY/private/key.pem"
|
||||
'';
|
||||
serviceConfig = {
|
||||
ExecStart = let
|
||||
hook = mkHook zone;
|
||||
days = "--days ${builtins.toString cfg.days}";
|
||||
staging =
|
||||
if cfg.staging
|
||||
then "--staging"
|
||||
else "";
|
||||
in "${pkgs.uacme} --verbose --days ${days} --hook ${hook} ${staging} issue ${zone}";
|
||||
DynamicUser = "yes";
|
||||
StateDirectory = "nsd-acme/${sanitized}";
|
||||
RuntimeDirectory = "nsd-acme/${sanitized}";
|
||||
LoadCredential = let
|
||||
rc = config.services.nsd.remoteControl;
|
||||
in [
|
||||
"nsd_control.key:${rc.controlKeyFile}"
|
||||
"nsd_control.pem:${rc.controlCertFile}"
|
||||
"nsd_server.key:${rc.serverKeyFile}"
|
||||
"nsd_server.pem:${rc.serverCertFile}"
|
||||
"letsencrypt-account.key:${cfg.accountKey}"
|
||||
];
|
||||
};
|
||||
}
|
||||
)
|
||||
config.mj.services.nsd-acme.zones;
|
||||
|
||||
mj.base.unitstatus.units = lib.mkIf config.mj.base.unitstatus.enable ["nsd-control-setup"];
|
||||
};
|
||||
}
|
||||
Loading…
Reference in New Issue