!MthpOIxqJhTgrMNxDS:nixos.org

NixOS ACME / LetsEncrypt

103 Members
Another day, another cert renewal42 Servers

Load older messages


SenderMessageTime
26 Oct 2021
@mjolnir:nixos.orgNixOS Moderation Bot set a profile picture.02:00:35
@mjolnir:nixos.orgNixOS Moderation Bot changed their profile picture.02:23:50
@mjolnir:nixos.orgNixOS Moderation Bot changed their profile picture.02:33:19
6 Nov 2021
@test:boba.bestTseb joined the room.09:19:26
@test:boba.bestTseb left the room.09:25:07
9 Nov 2021
@haugh:matrix.orghaugh left the room.20:10:47
11 Nov 2021
@mobyturbo:matrix.orgEdLin joined the room.07:46:23
@mobyturbo:matrix.orgEdLin left the room.08:03:18
16 Nov 2021
@moritz.hedtke:matrix.orgmoritz.hedtke joined the room.10:48:54
20 Nov 2021
@nykw:tchncs.denykw joined the room.11:10:15
23 Nov 2021
@server_stats:nordgedanken.devServer Stats Discoverer (traveler bot) left the room.02:35:48
24 Nov 2021
@m1cr0man:m1cr0man.comm1cr0manJust looking through github for acme-related work. I found this old PR: https://github.com/NixOS/nixpkgs/pull/46379 about letting useAcmeHost=true vhosts add their aliases to the acme cert automatically. I'm actually against this idea - the main use case nowadays for useAcmeHost is specifying a wildcard cert to use with a bunch of stuff, and that would generally be a better idea than having a cert with lots of subject alternate names. Fwiw, if you just enableACME on a vhost we already do build a cert that includes serverAliases in extraDomains (see https://github.com/NixOS/nixpkgs/blob/c18638dc95216b1b2930d16e1334613d82d05e8e/nixos/modules/services/web-servers/nginx/default.nix#L935)21:37:23
@hexa:lossy.networkhexa m1cr0man: can i pm you to look at an acme issue? 22:04:31
@m1cr0man:m1cr0man.comm1cr0manyeah sure! Or just shout here like22:04:59
@hexa:lossy.networkhexauh ok, I'll try to explain instead of posting logs22:05:34
@hexa:lossy.networkhexaI have a cert with olddomain.example.com example.com22:05:49
@hexa:lossy.networkhexaand I rmeoved olddomain.example.com22:05:53
@hexa:lossy.networkhexaand now I try to renew and it still tries to renew olddomain.example.com22:06:05
@hexa:lossy.networkhexathe olddomain is not part of the lego command22:07:00
@m1cr0man:m1cr0man.comm1cr0manhm interesting ok22:07:01
@m1cr0man:m1cr0man.comm1cr0manah22:07:06
@hexa:lossy.networkhexathat's on 21.0522:07:18
@m1cr0man:m1cr0man.comm1cr0manit's been a while 😅 lemme glance at the module again22:07:21
@m1cr0man:m1cr0man.comm1cr0manI think someone reported/saw this in some issue before, but it was shrugged off as a fluke. I have a fair idea what it could be22:09:34
@hexa:lossy.networkhexaanyway, I would have expected the domainhash to resolve that22:16:10
@m1cr0man:m1cr0man.comm1cr0manyeah, me too. I'm just looking at the conditionals surrounding it22:16:37
@hexa:lossy.networkhexathe old domain is not part of the ExecStart script22:17:18
@m1cr0man:m1cr0man.comm1cr0manOk I think I see what's up22:17:27
@m1cr0man:m1cr0man.comm1cr0manextraDomains is not part of the hashData, which is what certDir is set based upon22:17:42
@m1cr0man:m1cr0man.comm1cr0manI need to get that vs code plugin that lets me get links to github files..22:18:11

Show newer messages


Back to Room ListRoom Version: 6