From 9d019f2b9abefd1a1e893a72b4d310c9aaa46f1f Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Torjus=20H=C3=A5kestad?= Date: Sat, 7 Feb 2026 18:22:28 +0100 Subject: [PATCH] testvm01: add nginx with ACME certificate for PKI testing Set up a simple nginx server with an ACME certificate from the new OpenBao PKI infrastructure. This allows testing the ACME migration before deploying to production hosts. Co-Authored-By: Claude Opus 4.5 --- hosts/testvm01/configuration.nix | 33 ++++++++++++++++++++++++++++++++ 1 file changed, 33 insertions(+) diff --git a/hosts/testvm01/configuration.nix b/hosts/testvm01/configuration.nix index c493c76..572084b 100644 --- a/hosts/testvm01/configuration.nix +++ b/hosts/testvm01/configuration.nix @@ -62,6 +62,39 @@ git ]; + # Test nginx with ACME certificate from OpenBao PKI + services.nginx = { + enable = true; + virtualHosts."testvm01.home.2rjus.net" = { + forceSSL = true; + enableACME = true; + locations."/" = { + root = pkgs.writeTextDir "index.html" '' + + + + testvm01 - ACME Test + + + +

OpenBao PKI ACME Test

+

If you're seeing this over HTTPS, the migration worked!

+
+

Why do programmers prefer dark mode?

+

Because light attracts bugs.

+
+

Certificate issued by: vault.home.2rjus.net

+ + + ''; + }; + }; + }; + # Open ports in the firewall. # networking.firewall.allowedTCPPorts = [ ... ]; # networking.firewall.allowedUDPPorts = [ ... ];