diff options
author | Lynn <code@lynn.is> | 2024-05-01 16:48:07 +0200 |
---|---|---|
committer | Lynn <code@lynn.is> | 2024-05-01 16:48:07 +0200 |
commit | a586e82ef6c96b1425810550a43cfa4c1c947307 (patch) | |
tree | ed39972ff90f92955ced7ab5a572f46115415d5d /nixos/modules | |
parent | 9f84a634600901698925b7deae0955ec745cf41b (diff) |
nixos/nginx: don't add .well-known locations for acme when using DNS-01 challenge
Diffstat (limited to 'nixos/modules')
-rw-r--r-- | nixos/modules/services/web-servers/nginx/default.nix | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/nixos/modules/services/web-servers/nginx/default.nix b/nixos/modules/services/web-servers/nginx/default.nix index 337d53e869efe..08fab09e1e559 100644 --- a/nixos/modules/services/web-servers/nginx/default.nix +++ b/nixos/modules/services/web-servers/nginx/default.nix @@ -352,7 +352,8 @@ let # The acme-challenge location doesn't need to be added if we are not using any automated # certificate provisioning and can also be omitted when we use a certificate obtained via a DNS-01 challenge - acmeLocation = optionalString (vhost.enableACME || (vhost.useACMEHost != null && config.security.acme.certs.${vhost.useACMEHost}.dnsProvider == null)) + acmeName = if vhost.useACMEHost != null then vhost.useACMEHost else vhostName; + acmeLocation = optionalString ((vhost.enableACME || vhost.useACMEHost != null) && config.security.acme.certs.${acmeName}.dnsProvider == null) # Rule for legitimate ACME Challenge requests (like /.well-known/acme-challenge/xxxxxxxxx) # We use ^~ here, so that we don't check any regexes (which could # otherwise easily override this intended match accidentally). |