flake-parts: Almost done with yggdrasil

modules/server/acme.nix

@@ -0,0 +1,60 @@
+{
+  flake.modules.nixos.server =
+    {
+      config,
+      lib,
+      ...
+    }:
+    let
+      sopsFile = ../../secrets/secrets-loptland.yaml;
+      domainname = "christophhollizeck.dev";
+    in
+    {
+      sops = {
+        secrets = {
+          "netcup/customer_number" = {
+            inherit sopsFile;
+          };
+
+          "netcup/api/key" = {
+            inherit sopsFile;
+          };
+
+          "netcup/api/password" = {
+            inherit sopsFile;
+          };
+        };
+
+        templates = {
+          "netcup.env" = {
+            content = ''
+              NETCUP_CUSTOMER_NUMBER=${config.sops.placeholder."netcup/customer_number"}
+              NETCUP_API_KEY=${config.sops.placeholder."netcup/api/key"}
+              NETCUP_API_PASSWORD=${config.sops.placeholder."netcup/api/password"}
+              NETCUP_PROPAGATION_TIMEOUT=1200
+            '';
+          };
+        };
+
+      };
+
+      security.acme = {
+        acceptTerms = true;
+        defaults = {
+          inherit (config.flake.meta.users.cholli) email;
+
+          group = lib.optional config.services.nginx.enable "nginx";
+          reloadServices = lib.optional config.services.nginx.enable "nginx.service";
+
+          dnsProvider = "netcup";
+          environmentFile = config.sops.templates."netcup.env".path;
+        };
+
+        certs."${domainname}" = {
+          dnsResolver = "1.1.1.1:53";
+          extraDomainNames = [ "*.${domainname}" ];
+        };
+      };
+
+    };
+}