=

oluceps · Oct 14, 2024 · f9d0bcc · f9d0bcc
1 parent d85fc94
commit f9d0bcc
Show file tree

Hide file tree

Showing 2 changed files with 29 additions and 32 deletions.
diff --git a/hosts/hastur/caddy.nix b/hosts/hastur/caddy.nix
@@ -146,35 +146,35 @@
           };
         };
         tls = {
-          automation.policies = [
-            {
-              subjects = [
-                "*.nyaw.xyz"
-                "nyaw.xyz"
-              ];
-              issuers = [
-                {
-                  module = "acme";
-                  challenges = {
-                    dns = {
-                      provider = {
-                        name = "porkbun";
-                        api_key = "{env.PORKBUN_API_KEY}";
-                        api_secret_key = "{env.PORKBUN_API_SECRET_KEY}";
-                      };
-                    };
-                  };
-                }
-              ];
-            }
-          ];
-          # certificates.load_files = [
+          # automation.policies = [
           #   {
-          #     certificate = "/run/credentials/caddy.service/nyaw.cert";
-          #     key = "/run/credentials/caddy.service/nyaw.key";
-          #     tags = [ "cert0" ];
+          #     subjects = [
+          #       "*.nyaw.xyz"
+          #       "nyaw.xyz"
+          #     ];
+          #     issuers = [
+          #       {
+          #         module = "acme";
+          #         challenges = {
+          #           dns = {
+          #             provider = {
+          #               name = "porkbun";
+          #               api_key = "{env.PORKBUN_API_KEY}";
+          #               api_secret_key = "{env.PORKBUN_API_SECRET_KEY}";
+          #             };
+          #           };
+          #         };
+          #       }
+          #     ];
           #   }
           # ];
+          certificates.load_files = [
+            {
+              certificate = "/run/credentials/caddy.service/nyaw.cert";
+              key = "/run/credentials/caddy.service/nyaw.key";
+              tags = [ "cert0" ];
+            }
+          ];
         };
       };
     };

diff --git a/repack/reuse-cert.nix b/repack/reuse-cert.nix
@@ -26,12 +26,9 @@ reIf (
         acc
         // {
           ${i.name} = {
-            serviceConfig.LoadCredential = lib.mkIf i.cond (
-              (map (lib.genCredPath config)) [
-                "nyaw.cert"
-                "nyaw.key"
-              ]
-            );
+            serviceConfig.BindReadOnlyPaths = lib.mkIf i.cond [
+              "-/var/lib/caddy/certificates/acme-v02.api.letsencrypt.org-directory/"
+            ];
           };
         }
       ) { } nameCondPair)