acme: share accounts between certificates

There are strict rate limits on account creation for Let's Encrypt certificates. It is important to reuse credentails when possible. (cherry picked from commit 827d5e6)
dtzWill · May 21, 2020 · a50644f · a50644f
1 parent f83d41a
commit a50644f
Showing 1 changed file with 2 additions and 1 deletion.
diff --git a/nixos/modules/security/acme.nix b/nixos/modules/security/acme.nix
@@ -329,13 +329,14 @@ in
                     User = data.user;
                     Group = data.group;
                     PrivateTmp = true;
-                    StateDirectory = "acme/.lego/${cert} ${lpath}";
+                    StateDirectory = "acme/.lego/${cert} acme/.lego/accounts ${lpath}";
                     StateDirectoryMode = if data.allowKeysForGroup then "750" else "700";
                     WorkingDirectory = spath;
                     # Only try loading the credentialsFile if the dns challenge is enabled
                     EnvironmentFile = if data.dnsProvider != null then data.credentialsFile else null;
                     ExecStart = pkgs.writeScript "acme-start" ''
                       #!${pkgs.runtimeShell} -e
+                      test -L ${spath}/accounts -o -d ${spath}/accounts || ln -s ../accounts ${spath}/accounts
                       ${pkgs.lego}/bin/lego ${renewOpts} || ${pkgs.lego}/bin/lego ${runOpts}
                     '';
                     ExecStartPost =