torjus/nixos-servers
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects 1 Releases Wiki Activity

kanidm: add hostname SAN to ACME certificate
Some checks failed
Run nix flake check / flake-check (push) Failing after 1s
Details

Browse Source 
Include both auth.home.2rjus.net (CNAME) and kanidm01.home.2rjus.net
(A record) as SANs in the TLS certificate. This fixes Prometheus
scraping which connects via the hostname, not the CNAME.

Fixes: x509: certificate is valid for auth.home.2rjus.net, not kanidm01.home.2rjus.net

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
This commit is contained in:
Torjus Håkestad
2026-02-08 03:29:54 +01:00
parent 3f1d966919
commit de36b9d016
1 changed files with 2 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
services/kanidm/default.nix
View File

@@ -39,9 +39,11 @@
users.users.kanidm.extraGroups = [ "acme" ]; users.users.kanidm.extraGroups = [ "acme" ];
# ACME certificate from internal CA # ACME certificate from internal CA
# Include both the CNAME (auth) and A record (kanidm01) for Prometheus scraping
security.acme.certs."auth.home.2rjus.net" = { security.acme.certs."auth.home.2rjus.net" = {
listenHTTP = ":80"; listenHTTP = ":80";
reloadServices = [ "kanidm" ]; reloadServices = [ "kanidm" ];
extraDomainNames = [ "${config.networking.hostName}.home.2rjus.net" ];
}; };
# Vault secret for idm_admin password # Vault secret for idm_admin password