feat(server/web-servers): change acme validation to DNS-01

modules/nixos/server/web-servers/default.nix

@@ -1,72 +1,15 @@
-{ config, lib, ... }:
+{ config, ... }:
-let
-  cfg = config.server.web-servers;
-  proxyPasses = builtins.listToAttrs (
-    builtins.map (proxy: {
-      name = proxy.source;
-      value = {
-        forceSSL = true;
-        enableACME = true;
-        locations."/" = {
-          proxyPass = proxy.target;
-        } // proxy.extraConfig;
-      };
-    }) cfg.nginx.proxies
-  );
-in
 {
-  options.server.web-servers = {
+  config = {
-    nginx = {
+    security.acme = {
-      enable = lib.mkEnableOption "the Nginx server";
+      acceptTerms = true;
-      proxies = lib.mkOption {
+      defaults = {
-        type =
+        email = "rafiq@rrv.sh";
-          with lib.types;
+        dnsProvider = "cloudflare";
-          listOf (submodule {
+        credentialFiles = {
-            options = {
+          "CLOUDFLARE_DNS_API_TOKEN_FILE" = config.sops.secrets."keys/cloudflare".path;
-              source = lib.pantheon.mkStrOption;
+        };
-              target = lib.pantheon.mkStrOption;
-              extraConfig = lib.mkOption {
-                type = attrs;
-                default = { };
-                description = "Will be added to locations.\"/\"";
-              };
-            };
-          });
-        default = [ ];
-        example = [
-          {
-            source = "chat.bwfiq.com";
-            target = "http://helios:3080";
-            extraConfig = { };
-          }
-        ];
       };
     };
   };
-  config = lib.mkMerge [
-    {
-      security.acme = {
-        acceptTerms = true;
-        defaults.email = "rafiq@rrv.sh";
-      };
-    }
-    (lib.mkIf cfg.nginx.enable {
-      networking.firewall.allowedTCPPorts = [
-        443
-        80
-      ];
-      services.nginx = {
-        enable = true;
-        virtualHosts = {
-          "_" = {
-            default = true;
-            rejectSSL = true;
-            locations."/" = {
-              return = "444";
-            };
-          };
-        } // proxyPasses;
-      };
-    })
-  ];
 }

modules/nixos/server/web-servers/nginx/default.nix

@@ -0,0 +1,65 @@
+{ config, lib, ... }:
+let
+  cfg = config.server.web-servers.nginx;
+in
+{
+  options.server.web-servers.nginx = {
+    enable = lib.mkEnableOption "the Nginx server";
+    proxies = lib.mkOption {
+      type =
+        with lib.types;
+        listOf (submodule {
+          options = {
+            source = lib.pantheon.mkStrOption;
+            target = lib.pantheon.mkStrOption;
+            extraConfig = lib.mkOption {
+              type = attrs;
+              default = { };
+              description = "Will be added to locations.\"/\"";
+            };
+          };
+        });
+      default = [ ];
+      example = [
+        {
+          source = "chat.bwfiq.com";
+          target = "http://helios:3080";
+          extraConfig = { };
+        }
+      ];
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    networking.firewall.allowedTCPPorts = [
+      443
+      80
+    ];
+    services.nginx = {
+      enable = true;
+      virtualHosts =
+        {
+          "_" = {
+            default = true;
+            rejectSSL = true;
+            locations."/" = {
+              return = "444";
+            };
+          };
+        }
+        // (builtins.listToAttrs (
+          builtins.map (proxy: {
+            name = proxy.source;
+            value = {
+              forceSSL = true;
+              enableACME = true;
+              acmeRoot = null;
+              locations."/" = {
+                proxyPass = proxy.target;
+              } // proxy.extraConfig;
+            };
+          }) cfg.proxies
+        ));
+    };
+  };
+}