23 lines
1023 B
Nix
23 lines
1023 B
Nix
# Shared TSIG secret for a gateway's dedicated ACME key (function: machine
|
|
# name -> NixOS module). The acme_<machine> key lets that gateway — and only
|
|
# it — write _acme-challenge.<site><siteId> TXT records on the authoritative
|
|
# nameserver to obtain its internal wildcard cert via DNS-01 (proxy.nix).
|
|
#
|
|
# The router service declares it on the gateway automatically when
|
|
# proxy.enable is set. The nameserver machine must declare the very same
|
|
# generator so both sides share one secret:
|
|
# imports = [ (import <router-service>/acme-secret.nix "gw-cnx-1") ];
|
|
# and then load it into its DNS server as key acme_gw_cnx_1 (hmac-sha256)
|
|
# with an acl scoped to that gateway's _acme-challenge label.
|
|
machine:
|
|
{ pkgs, ... }:
|
|
{
|
|
clan.core.vars.generators."dns-acme-${machine}-secret" = {
|
|
share = true;
|
|
files."secret".secret = true;
|
|
runtimeInputs = [ pkgs.openssl ];
|
|
# 32 random bytes, base64 — a valid hmac-sha256 TSIG secret.
|
|
script = ''openssl rand -base64 32 | tr -d '\n' > "$out"/secret'';
|
|
};
|
|
}
|