Berwn
b11ff75ca6
cnx.router.proxy serves <service>.<site><n>.cnx.network with a real Let's Encrypt wildcard obtained via a gateway-scoped TSIG key against ns1; Blocky resolves the names to the router's LAN address, so they exist only internally. First user: Omada UI on gw-cnx-1 (omada.cnx1.cnx.network).
18 lines
773 B
Nix
18 lines
773 B
Nix
# Shared TSIG secret for a gateway's dedicated ACME key (function: machine
|
|
# name -> module). The acme_gw_<x> key lets that gateway — and only it — write
|
|
# _acme-challenge.<label> TXT records on ns1 to obtain its internal wildcard
|
|
# cert via DNS-01. ns1 scopes it with a matching acl on the cnx.network zone.
|
|
# Import on BOTH ns1 and the gateway machine, applied with the machine name:
|
|
# (import ../../modules/dns/acme-gw-secret.nix "gw-cnx-1")
|
|
machine:
|
|
{ pkgs, ... }:
|
|
{
|
|
clan.core.vars.generators."dns-acme-${machine}-secret" = {
|
|
share = true;
|
|
files."secret".secret = true;
|
|
runtimeInputs = [ pkgs.openssl ];
|
|
# 32 random bytes, base64 — a valid hmac-sha256 TSIG secret.
|
|
script = ''openssl rand -base64 32 | tr -d '\n' > "$out"/secret'';
|
|
};
|
|
}
|