module: add acme

machines/modules/acme.nix

@@ -0,0 +1,46 @@
+{ pkgs, lib, config, options, ... }:
+
+let
+  cfg = config.my.modules.acme;
+
+in
+
+{
+  options = with lib; {
+    my = {
+      modules = {
+        acme = {
+          enable = mkEnableOption ''
+            Whether to enable acme module
+          '';
+        };
+      };
+    };
+  };
+
+  config = with lib;
+    mkIf cfg.enable {
+      security = {
+        acme = {
+          acceptTerms = true;
+
+          defaults = {
+            email = "hostmaster@boerger.ws";
+          };
+
+          certs = {
+            "home.boerger.ws" = {
+              domain = "*.home.boerger.ws";
+              dnsProvider = "cloudflare";
+              credentialsFile = config.age.secrets.acme.path;
+            };
+          };
+        };
+      };
+
+      age.secrets.acme = {
+        file = ../../secrets/acme.age;
+        owner = "acme";
+      };
+    };
+}

machines/modules/default.nix

@@ -4,6 +4,7 @@
   imports = [
     ./settings.nix
 
+    ./acme.nix
     ./boot.nix
     ./haveged.nix
     ./network.nix
@@ -16,6 +17,10 @@
 
   my = {
     modules = {
+      acme = {
+        enable = lib.mkDefault false;
+      };
+
       boot = {
         enable = lib.mkDefault true;
       };

machines/utgard/default.nix

@@ -10,6 +10,14 @@
     ./networking.nix
   ];
 
+  my = {
+    modules = {
+      acme = {
+        enable = true;
+      };
+    };
+  };
+
   system = {
     stateVersion = "21.11";
   };

secrets/secrets.nix

@@ -0,0 +1,7 @@
+let
+  thomas = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINaQYR0/Oj6k1H03kshz2J7rlGCaDSuaGPhhOs9FcZfn";
+  users = [ thomas ];
+in
+{
+  "acme.age".publicKeys = users;
+}