DRY security.acme

hosts/containers/hydra/default.nix

@@ -13,10 +13,6 @@
 
   nixpkgs.config.allowUnfree = true;
 
-  security.acme = {
-    email = "mail@c3d2.de";
-    acceptTerms = true;
-  };
   security.pam.enableSSHAgentAuth = true;
 
   services.openssh = {

hosts/containers/kibana/default.nix

@@ -26,10 +26,6 @@
     package = pkgs.kibana7;
   };
 
-  security.acme = {
-    acceptTerms = true;
-    email = "mail@c3d2.de";
-  };
   services.nginx = let
     authFile = pkgs.writeText "htpasswd" "k-ot:sawCOTsl/fIUY";
     vhost = url: {

hosts/containers/matemat/default.nix

@@ -45,9 +45,4 @@
       hostname = "matemat.hq.c3d2.de";
     };
   };
-
-  security.acme = {
-    acceptTerms = true;
-    email = "mail@c3d2.de";
-  };
 }

hosts/containers/mobilizon/default.nix

@@ -49,8 +49,4 @@
       locations."/".proxyPass = "http://localhost:4000";
     };
   };
-  security.acme = {
-    acceptTerms = true;
-    email = "mail@c3d2.de";
-  };
 }

hosts/containers/scrape/default.nix

@@ -40,10 +40,6 @@ in {
       root = config.users.users.scrape.home;
     };
   };
-  security.acme = {
-    acceptTerms = true;
-    email = "mail@c3d2.de";
-  };
   networking.firewall.allowedTCPPorts = [ 80 443 ];
 
   systemd.services = let

hosts/containers/stream/default.nix

@@ -47,9 +47,4 @@ in
       };
     };
   };
-
-  security.acme = {
-    acceptTerms = true;
-    email = "mail@c3d2.de";
-  };
 }

hosts/pulsebert/default.nix

@@ -135,11 +135,6 @@ in
     };
   };
 
-  security.acme = {
-    acceptTerms = true;
-    email = "mail@c3d2.de";
-  };
-
   services.nginx = {
     enable = true;
     #recommendedGzipSettings = true;

hosts/radiobert/default.nix

@@ -149,10 +149,6 @@
       };
     };
   };
-  security.acme = {
-    acceptTerms = true;
-    email = "mail@c3d2.de";
-  };
 
   # Allow access to USB
   services.udev.extraRules = ''

lib/default.nix

@@ -60,6 +60,14 @@ in {
         '';
       };
 
+      acmeEmail = mkOption {
+        type = str;
+        default = "mail@c3d2.de";
+        description = ''
+          Admin email address to use for Letsencrypt
+        '';
+      };
+
       hq = {
 
         /* externalInterface = mkOption {
@@ -258,6 +266,11 @@ in {
       rebootTime = "15s";
     };
 
+    # Defaults for LetsEncrypt
+    security.acme = {
+      acceptTerms = true;
+      email = cfg.acmeEmail;
+    };
   };
 
   meta.maintainers = with lib.maintainers; [ ehmry ];