CCCHH/nix-infra
CCCHH/nix-infra
Watch
2
3
Fork
You've already forked nix-infra
 2
Code Issues Pull requests 2 Wiki Activity

public-web-static: make element-admin cert work again

Browse source 
Replace broken *.staging.diday.org cert setup with snakeoil cert to make
element-admin cert work again.
This commit is contained in:
June 2026-11-11 21:47:57 +01:00
commit a6167eeb14
Signed by: june
SSH key fingerprint: SHA256:o9EAq4Y9N9K0pBQeBTqhSDrND5E7oB+60ZNx0U1yPe0
1 changed files with 5 additions and 13 deletions
Download patch file Download diff file Expand all files Collapse all files

18
config/hosts/public-web-static/virtualHosts/staging.diday.org.nix
View file

@ -1,4 +1,4 @@
{ config, ... }:
{ config, pkgs, ... }:
let
domain = "staging.diday.org";
@ -6,20 +6,14 @@ let
deployUser = "diday-website-deploy";
in
{
security.acme.certs."${domain}" = {
domain = "staging.diday.org";
extraDomainNames = [ "*.staging.diday.org" ];
group = "nginx";
dnsResolver = "45.54.76.1:53";
dnsProvider = "desec";
environmentFile = config.sops.secrets."staging.diday.org/lego.env".path;
};
services.nginx.virtualHosts = {
"*.${domain}" = {
useACMEHost = "${domain}";
forceSSL = true;
# https://discourse.nixos.org/t/where-can-i-get-snakeoil-certificates/14628/4
sslCertificate = "${pkgs.path}/nixos/tests/common/acme/server/acme.test.cert.pem";
sslCertificateKey = "${pkgs.path}/nixos/tests/common/acme/server/acme.test.key.pem";
listen = [
{
addr = "[::]";
@ -78,6 +72,4 @@ in
systemd.tmpfiles.rules = [
"d ${dataDir} 0755 ${deployUser} ${deployUser}"
];
sops.secrets."staging.diday.org/lego.env" = {};
}