# These StateDirectory entries negate the need for tmpfiles
      StateDirectory = [ "acme" "acme/.lego" "acme/.lego/accounts" ];
      StateDirectoryMode = 755;
      WorkingDirectory = "/var/lib/acme";

...ah.

Got it. I feel like that can definitely be documented better, I’ll PR if I can think of adequate wording.

Question: why can’t we assume, though? In what scenario would someone be using one certificate across multiple HTTP servers? idk, just seems unlikely, it’s definitely best not to assume but i can’t think of an actual practical use case unless I’m just missing something obvious…

This is in the example on how to auto generate TSIG keys with a systemd service. https://nixos.org/manual/nixos/unstable/index.html#module-security-acme-config-dns
Spot the issue? :P
I'll do a PR at some point.. maybe tomorrow

    cat > /var/lib/secrets/certs.secret << EOF
    RFC2136_NAMESERVER='127.0.0.1:53'
    RFC2136_TSIG_ALGORITHM='hmac-sha256.'
    RFC2136_TSIG_KEY='rfc2136key.example.com'
    RFC2136_TSIG_SECRET='your secret key'
    EOF

In reply to @m1cr0man:m1cr0man.com
Winter I was thinking that it might be possible to add an assertion in nginx/httpd/caddy to check acme cert access too, which would at least cover your concern about it unexpectedly failing. It would be complex though, idk if nix does anything in the config tree to merge users.users. .extraGroups and users.groups. .extraUsers that I could reference