public
/
nixpkgs
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Merge pull request #80856 from emilazy/adjust-acme 

nixos/acme: adjust renewal timer options
This commit is contained in:
Yegor Timoshenko 2020-03-03 03:49:33 +03:00 committed by GitHub
parent c37b4466c0 7b14bbd734
commit 31aefc74c5
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 15 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

19
nixos/modules/security/acme.nix
View File

@ -174,7 +174,7 @@ in
renewInterval = mkOption { renewInterval = mkOption {
type = types.str; type = types.str;
default = "weekly"; default = "daily";
description = '' description = ''
Systemd calendar expression when to check for renewal. See Systemd calendar expression when to check for renewal. See
<citerefentry><refentrytitle>systemd.time</refentrytitle> <citerefentry><refentrytitle>systemd.time</refentrytitle>
@ -400,7 +400,17 @@ in
systemd.tmpfiles.rules = systemd.tmpfiles.rules =
map (data: "d ${data.webroot}/.well-known/acme-challenge - ${data.user} ${data.group}") (filter (data: data.webroot != null) (attrValues cfg.certs)); map (data: "d ${data.webroot}/.well-known/acme-challenge - ${data.user} ${data.group}") (filter (data: data.webroot != null) (attrValues cfg.certs));
systemd.timers = flip mapAttrs' cfg.certs (cert: data: nameValuePair systemd.timers = let
# Allow systemd to pick a convenient time within the day
# to run the check.
# This allows the coalescing of multiple timer jobs.
# We divide by the number of certificates so that if you
# have many certificates, the renewals are distributed over
# the course of the day to avoid rate limits.
numCerts = length (attrNames cfg.certs);
_24hSecs = 60 * 60 * 24;
AccuracySec = "${toString (_24hSecs / numCerts)}s";
in flip mapAttrs' cfg.certs (cert: data: nameValuePair
("acme-${cert}") ("acme-${cert}")
({ ({
description = "Renew ACME Certificate for ${cert}"; description = "Renew ACME Certificate for ${cert}";
@ -409,8 +419,9 @@ in
OnCalendar = cfg.renewInterval; OnCalendar = cfg.renewInterval;
Unit = "acme-${cert}.service"; Unit = "acme-${cert}.service";
Persistent = "yes"; Persistent = "yes";
AccuracySec = "5m"; inherit AccuracySec;
RandomizedDelaySec = "1h"; # Skew randomly within the day, per https://letsencrypt.org/docs/integration-guide/.
RandomizedDelaySec = "24h";
}; };
}) })
); );