blob: edba11b656264d320a8d1a08f15e0c56d7600474 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
|
# ACME/SSL
we now have our own letsencrypt-like service for internal certificates:
## howto trust the CA
```
security.pki.certificateFiles = [(pkgs.fetchurl {
url = "http://ca.r/ca.crt"; # can be also downloaded from some other location like github/cgit
sha256 = "sha256-qd3HYc/HaMGbrHDjTKgs4QbHTRcA//xxr+fu1FnKBBs=";
})]
```
## get a certificate from CA (need to trust CA first)
```
services.nginx.virtualHosts."myservice.r" = {
enableACME = true;
}
security.acme.certs."myservice.r".server = "https://ca.r/acme/acme/directory";
```
|
