movefasta/nixpkgs
0
0
Fork 0
mirror of https://github.com/NixOS/nixpkgs.git synced 2025-07-13 13:40:28 +03:00
Code Activity

Merge pull request #77578 from m1cr0man/master

Browse source 
Replace simp-le with lego and support DNS-01 challenge
This commit is contained in:
Florian Klink 2020-02-10 11:47:30 +01:00 • committed by GitHub
commit 4e0fea3fe2
6 changed files with 256 additions and 61 deletions
Download patch file Download diff file Expand all files Collapse all files

15
nixos/doc/manual/release-notes/rl-2003.xml
View file

@ -660,6 +660,21 @@ auth required pam_succeed_if.so uid >= 1000 quiet
<literal>PRETTY_NAME</literal> in <literal>/etc/os-release</literal>
now uses the short rather than full version string.
</para>
</listitem>
<listitem>
<para>
The ACME module has switched from simp-le to <link xlink:href="https://github.com/go-acme/lego">lego</link>
which allows us to support DNS-01 challenges and wildcard certificates. The following options have been added:
<link linkend="opt-security.acme.acceptTerms">security.acme.acceptTerms</link>,
<link linkend="opt-security.acme.certs">security.acme.certs.&lt;name&gt;.dnsProvider</link>,
<link linkend="opt-security.acme.certs">security.acme.certs.&lt;name&gt;.credentialsFile</link>,
<link linkend="opt-security.acme.certs">security.acme.certs.&lt;name&gt;.dnsPropagationCheck</link>.
As well as this, the options <literal>security.acme.acceptTerms</literal> and either
<literal>security.acme.email</literal> or <literal>security.acme.certs.&lt;name&gt;.email</literal>
must be set in order to use the ACME module.
Certificates will be regenerated anew on the next renewal date. The credentials for simp-le are
preserved and thus it is possible to roll back to previous versions without breaking certificate
generation.
</listitem>
<listitem>
<para>