blob: 79ba8ab0d04b921d42edcd9fab69e1f8a7031f32 (
plain) (
tree)
|
|
{...}: let
taskStore = "/var/lib/taskserver";
in {
imports = [
./connected_users.nix
];
services.taskserver = {
enable = true;
pki.manual = {
ca.cert = ./certs/ca.cert.pem;
server = {
cert = "${taskStore}/fullchain.pem";
key = "${taskStore}/key.pem";
};
};
debug = false;
ipLog = false;
trust = "strict";
organisations = import ./organisations.nix;
openFirewall = true;
fqdn = "taskserver.vhack.eu";
# This should tell taskd to bind to both ipv6 and ipv4 domains:
# This will ONLY work when the kernel option `sys.net.ipv6.bindv6only` is false
listenHost = "::";
};
security.acme.certs.taskserver = {
domain = "taskserver.vhack.eu";
postRun =
/*
bash
*/
''
set -x
rm "${taskStore}/key.pem"
rm "${taskStore}/fullchain.pem"
cp key.pem "${taskStore}";
cp fullchain.pem "${taskStore}";
chown taskd:taskd "${taskStore}/key.pem"
chown taskd:taskd "${taskStore}/fullchain.pem"
'';
};
}
|