Got it. I feel like that can definitely be documented better, I’ll PR if I can think of adequate wording.

Question: why can’t we assume, though? In what scenario would someone be using one certificate across multiple HTTP servers? idk, just seems unlikely, it’s definitely best not to assume but i can’t think of an actual practical use case unless I’m just missing something obvious…

This is in the example on how to auto generate TSIG keys with a systemd service. https://nixos.org/manual/nixos/unstable/index.html#module-security-acme-config-dns
Spot the issue? :P
I'll do a PR at some point.. maybe tomorrow

    cat > /var/lib/secrets/certs.secret << EOF
    RFC2136_NAMESERVER='127.0.0.1:53'
    RFC2136_TSIG_ALGORITHM='hmac-sha256.'
    RFC2136_TSIG_KEY='rfc2136key.example.com'
    RFC2136_TSIG_SECRET='your secret key'
    EOF

In reply to @m1cr0man:m1cr0man.com
Winter I was thinking that it might be possible to add an assertion in nginx/httpd/caddy to check acme cert access too, which would at least cover your concern about it unexpectedly failing. It would be complex though, idk if nix does anything in the config tree to merge users.users. .extraGroups and users.groups. .extraUsers that I could reference

In reply to @m1cr0man:m1cr0man.com
V curious to know what the answer is. Acme isn't the only module that is a dependency in other modules (namely I'm thinking of all the services that can auto configure virtual hosts). There doesn't seem to be a set place for these sort of helpers right now

In reply to @winterqt:nixos.dev
m1cr0man: I promise I haven't forgotten about the assertions, it's just been a long week and want to do this the right way. If not sometime this week, I'll get a PR open this weekend. My apologies!