From 6379225731bcbd63cfe818219452a43136789309 Mon Sep 17 00:00:00 2001
From: derped <derped@ophanim.de>
Date: Wed, 11 Mar 2020 01:53:04 +0100
Subject: [PATCH] LetsEncrypt acme now requires an email and accepting their
 TOS.

---
 fn.nix               |  3 +++
 services/acme.nix    | 17 +++++++++++++++++
 services/default.nix |  1 +
 3 files changed, 21 insertions(+)
 create mode 100644 services/acme.nix

diff --git a/fn.nix b/fn.nix
index 411f7fd..bd0a071 100644
--- a/fn.nix
+++ b/fn.nix
@@ -5,6 +5,9 @@ with lib;
 
 rec {
   ifelse = a: b: c: if a then b else c;
+  fileContentsOr = a: b: (ifelse
+    (pathIsRegularFile a)
+    a b);
   cwd = toString ./.;
   lst = { p ? cwd, t ? "regular", b ? false }: (lists.forEach
     (attrNames
diff --git a/services/acme.nix b/services/acme.nix
new file mode 100644
index 0000000..6fd29f6
--- /dev/null
+++ b/services/acme.nix
@@ -0,0 +1,17 @@
+{ options, config, lib, pkgs, ... }:
+
+with builtins;
+with lib;
+
+let
+  fn = import (../. + (toPath "/fn.nix")) { inherit lib; };
+  cfg = config.machine;
+in mkIf (elem "acme" cfg.services) {
+  security.acme = {
+    # see https://letsencrypt.org/repository/
+    acceptTerms = true;
+    email = fn.fileContentsOr
+      (toPath "${cfg.secretPath}/acme.mailAddr")
+      "${(elemAt cfg.mailAccounts 0).name}@${cfg.domain}";
+  };
+}
diff --git a/services/default.nix b/services/default.nix
index 7dc3c30..cd37302 100644
--- a/services/default.nix
+++ b/services/default.nix
@@ -1,5 +1,6 @@
 {
   imports = [
+    ./acme.nix
     ./cups.nix
     ./docker.nix
     ./fail2ban.nix