!MthpOIxqJhTgrMNxDS:nixos.org

NixOS ACME / LetsEncrypt

106 Members
Another day, another cert renewal44 Servers

You have reached the beginning of time (for this room).


SenderMessageTime
16 May 2025
@emilazy:matrix.orgemilyas long as you/the project get value out of you being able to hit the merge button, and you hit it responsibly, it's all good for any level of activity > 013:07:00
@emilazy:matrix.orgemily(not on the SC, thank god)13:07:46
@emilazy:matrix.orgemily(but I do try to juggle too many hats)13:07:53
@m1cr0man:m1cr0man.comm1cr0manAh sorry, mixing people up 😅 but I still see you everywhere13:08:05
@emilazy:matrix.orgemilyI can't believe the rewrite was half a decade ago now…13:08:16
@m1cr0man:m1cr0man.comm1cr0man.pfffff. I did it for my uni's network society and I'm pretty sure it's still doing the heavy lifting to this day. Isn't it over half a decade like 2019? Jeez 13:09:35
@emilazy:matrix.orgemilyit was 202013:15:19
@emilazy:matrix.orgemilyfeels like yesterday, though13:15:35
@m1cr0man:m1cr0man.comm1cr0man https://github.com/m1cr0man/nixpkgs/commit/8fb8d665ddc993f859a96e73a1c51982eac72b94 wrote a wee changelog hexa , not sure if you want to commit this up to codemaster's branch or if I create a separate PR 13:34:28
@hexa:lossy.networkhexapicking14:02:43
21 May 2025
@spaenny:tchncs.deSpaenny joined the room.10:57:09
23 May 2025
@woobilicious:matrix.orgwoobilicious Is there an easy way to disable acme for test servers/vms? I know nixos-rebuild has a profile system, would that be how you do it? 00:15:39
@hexa:lossy.networkhexanot an acme specific question00:36:18
@hexa:lossy.networkhexa you would need to nuke security.acme.certs to an empty attreset 00:37:25
@hexa:lossy.networkhexa and also things like enableACME on nginx 00:37:37
@hexa:lossy.networkhexa #users:nixos.org 00:37:44
@hexa:lossy.networkhexa * #users:nixos.org is the room tbh 00:37:49
@m1cr0man:m1cr0man.comm1cr0man woobilicious: Ditto what hexa said - however you can DIY your own "disable all ACME" option. Just add a config option of your own (config.woobilicious.enableACME for example), then predicate your security.acme.certs and enableACME on that wherever you have it declared 18:55:38
@m1cr0man:m1cr0man.comm1cr0manI assume you're dealing with a test vm, is the root of this issue that ACME is looking for internet access to renew certs whilst testing your real system config? I personally don't know how to deal with that just for the test system, but IIRC there is some flag/marker that you are in a test vm?18:57:06
24 May 2025
@woobilicious:matrix.orgwoobilicious m1cr0man:
Yeah I'm wanting to use nixos-rebuild test-vm, I used to use it before I hooked up ACME but I knew instantly it would cause issues, so I just started testing in production lol.
My real issue is that I still need certs for some of my config to work correctly. I guess I'll have to look in to profile system and how ACME works to have it generate certs but not try sign them.
03:49:08
@woobilicious:matrix.orgwoobiliciousI want to add anubis to my server, so it's going to be a whole ordeal getting the proxy setup and the certs working correctly.03:54:13
@soispha:vhack.euBenedikt
In reply to @woobilicious:matrix.org
m1cr0man:
Yeah I'm wanting to use nixos-rebuild test-vm, I used to use it before I hooked up ACME but I knew instantly it would cause issues, so I just started testing in production lol.
My real issue is that I still need certs for some of my config to work correctly. I guess I'll have to look in to profile system and how ACME works to have it generate certs but not try sign them.
This might be overkill for your use case, but we set up an additional acme and name_server nodes that we can use to replace the real acme servers in tests
08:13:07

Show newer messages


Back to Room ListRoom Version: 6