peter/haccfiles
1
0
Fork 0
forked from hacc/haccfiles
Code Issues Pull requests Projects Releases Wiki Activity

mumble: ssl for everyone :party:

Browse source
This commit is contained in:
Moira 2022-09-24 16:30:14 +02:00
parent 7e615e6daa
commit 9e89ff6aa9
Signed by untrusted user: moira
GPG key ID: AF92FDD91CB44B2F
1 changed files with 21 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

23
services/murmur.nix
View file

@ -15,9 +15,28 @@
networking.firewall.allowedTCPPorts = [ config.services.murmur.port ]; networking.firewall.allowedTCPPorts = [ config.services.murmur.port ];
networking.firewall.allowedUDPPorts = [ config.services.murmur.port ]; networking.firewall.allowedUDPPorts = [ config.services.murmur.port ];
# the mumble cert has its own group so that both nginx and murmur can read it # create ssl certs for all used domains
services.nginx.virtualHosts = let
vhost = {
enableACME = true;
forceSSL = true;
};
in {
"mumble.hacc.space" = vhost;
"mumble.infra4future.de" = vhost;
};
# create group to share the certs
users.groups.mumblecert = {}; users.groups.mumblecert = {};
security.acme.certs."mumble.hacc.space".group = "mumblecert";
users.users.nginx.extraGroups = [ "mumblecert" ]; users.users.nginx.extraGroups = [ "mumblecert" ];
users.users.murmur.extraGroups = [ "mumblecert" ]; users.users.murmur.extraGroups = [ "mumblecert" ];
# merge the certs into one and reload murmur on update
security.acme.certs."mumble.hacc.space" = {
group = "mumblecert";
extraDomainNames = [ "pad.infra4future.de" ];
reloadServices = [ "murmur" ];
};
} }