mastus: acme breakage

mastus/letsencrypt.nix

@@ -5,16 +5,16 @@
     "gebner.org" = {
       webroot = "/var/lib/acme/acme-challenge";
       email = "gebner@gebner.org";
-      extraDomains = {
-        "git.gebner.org" = null;
-        "mail.gebner.org" = null;
-        "gebner.org" = null;
-        "www.gebner.org" = null;
-        "gabrielebner.at" = null;
-        "www.gabrielebner.at" = null;
-        "2b7e.org" = null;
-        "www.2b7e.org" = null;
-      };
+      extraDomains = [
+        "git.gebner.org"
+        "mail.gebner.org"
+        "gebner.org"
+        "www.gebner.org"
+        "gabrielebner.at"
+        "www.gabrielebner.at"
+        "2b7e.org"
+        "www.2b7e.org"
+      ];
 
       postRun = ''
         systemctl reload nginx

mastus/radicale.nix

@@ -24,7 +24,7 @@ in
     '';
   };
 
-  security.acme.certs."gebner.org".extraDomains."radicale.gebner.org" = null;
+  security.acme.certs."gebner.org".extraDomainNames = [ "radicale.gebner.org" ];
 
   services.nginx = {
     recommendedProxySettings = true;

mastus/ttrss.nix

@@ -65,7 +65,7 @@
   networking.nat.internalInterfaces = ["ve-+"];
   networking.nat.externalInterface = "ens3";
 
-  security.acme.certs."gebner.org".extraDomains."reader.gebner.org" = null;
+  security.acme.certs."gebner.org".extraDomainNames = [ "reader.gebner.org" ];
 
   services.nginx = {
     virtualHosts."reader.gebner.org" = {

mastus/website.nix

@@ -5,11 +5,10 @@
   services.nginx = {
     virtualHosts."gebner.org" = {
       enableACME = true;
-      useACMEHost = "gebner.org";
       forceSSL = true;
       root = "/srv/www.gebner.org";
       extraConfig = ''
-        access_log logs/website_access.log;
+        access_log /var/log/nginx/website_access.log;
 
         error_page 404 403 /404.html;
 

mastus/www.nix

@@ -30,8 +30,4 @@
     };
   };
 
-  # TODO: acme certificates are owned by root
-  # This workaround is from https://github.com/NixOS/nixpkgs/pull/84960
-  services.nginx.appendConfig = let cfg = config.services.nginx; in ''user ${cfg.user} ${cfg.group};'';
-  systemd.services.nginx.serviceConfig.User = pkgs.lib.mkForce "root";
 }