Torjus Håkestad
21db7e9573
Switch all ACME certificate issuance from step-ca (ca.home.2rjus.net) to OpenBao PKI (vault.home.2rjus.net:8200/v1/pki_int/acme/directory). - Update default ACME server in system/acme.nix - Update Caddy acme_ca in http-proxy and nix-cache services - Remove labmon service from monitoring01 (step-ca monitoring) - Remove labmon scrape target and certificate_rules alerts - Remove alloy.nix (only used for labmon profiling) - Add docs/plans/cert-monitoring.md for future cert monitoring needs Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
26 lines
485 B
Nix
26 lines
485 B
Nix
{ pkgs, ... }:
|
|
{
|
|
services.caddy = {
|
|
enable = true;
|
|
package = pkgs.unstable.caddy;
|
|
configFile = pkgs.writeText "Caddyfile" ''
|
|
{
|
|
acme_ca https://vault.home.2rjus.net:8200/v1/pki_int/acme/directory
|
|
metrics
|
|
}
|
|
|
|
|
|
nix-cache.home.2rjus.net {
|
|
log {
|
|
output file /var/log/caddy/nix-cache.log {
|
|
mode 644
|
|
}
|
|
}
|
|
metrics /metrics
|
|
|
|
reverse_proxy http://localhost:5000
|
|
}
|
|
'';
|
|
};
|
|
}
|