TheGeneralist
572647d7c4
- `internal.thegeneralist01.com` and `archive.thegeneralist01.com` are not public. I have Split DNS enabled on them (in Tailscale), with the IP of the DNS server set to a private Tailscale IP of my home server; - CoreDNS (also on my home server) is used to resolve the two private domains' IPs to the home server itself; - nginx only listens to its machine's (home server's) Tailscale IP; - Therefore, all of it is hermetic!
32 lines
719 B
Nix
32 lines
719 B
Nix
{ config, ... }: let
|
|
domain = "thegeneralist01.com";
|
|
in {
|
|
age.secrets.acmeEnvironment.file = ./acmeEnvironment.age;
|
|
|
|
security.acme = {
|
|
defaults = {
|
|
# Options: https://go-acme.github.io/lego/dns/acme
|
|
environmentFile = config.age.secrets.acmeEnvironment.path;
|
|
email = "thegeneralist01@proton.me";
|
|
dnsResolver = "1.1.1.1";
|
|
dnsProvider = "cloudflare";
|
|
};
|
|
|
|
certs = {
|
|
${domain} = {
|
|
extraDomainNames = [ "*.${domain}" ];
|
|
group = "acme";
|
|
};
|
|
"internal.${domain}" = {
|
|
group = "acme";
|
|
};
|
|
"archive.${domain}" = {
|
|
group = "acme";
|
|
};
|
|
};
|
|
|
|
acceptTerms = true;
|
|
};
|
|
|
|
users.groups.acme.members = [ "nginx" ];
|
|
}
|