dotfiles/nixos/modules/services/acme.nix

{
  config,
  flake,
  ...
}: let
  inherit (flake.config.people) user0;
  inherit (flake.config.people.user.${user0}) email;
  inherit (flake.config.service) instance;

  domain0 = instance.web.domains.url0;
  domain1 = instance.web.domains.url1;
  dns = instance.web.dns.provider0;

  instanceName = service: (instance.${service}.subdomain);

  dnsConfig = {
    dnsProvider = dns;
    directory = instance.acme.paths.path0;
    environmentFile = config.sops.secrets."dns/namecheap".path;
  };
in {
  security.acme = {
    acceptTerms = true;
    defaults = {
      email = email.address0;
      server = "https://acme-v02.api.letsencrypt.org/directory";
    };
    certs = builtins.listToAttrs (
      (map (prefix: {
          name = "${prefix}.${domain0}";
          value = dnsConfig;
        })
        map
        instanceName [
          "nextcloud"
          "jellyfin"
          "minecraft"
          "ollama"
          "syncthing"
          "vaultwarden"
        ])
      ++ (map (prefix: {
          name = "${prefix}.${domain1}";
          value = dnsConfig;
        })
        map
        instanceName [
          "wiki"
          "nextcloud"
          "castopod"
          "forgejo"
          "matrix"
          "owncast"
          "peertube"
          "writefreely"
        ])
      ++ (map (name: {
          name = name;
          value = dnsConfig;
        })
        [
          domain0
          domain1
        ])
    );
  };

  sops = let
    sopsSecrets = ["pass"];
    sopsPath = secret: {
      path = "/var/lib/secrets/${instance.acme.name}/${dns}-${secret}";
      owner = "root";
      mode = "600";
    };
  in {
    secrets = builtins.listToAttrs (
      map
      (secret: {
        name = "dns/${dns}";
        value = sopsPath secret;
      })
      sopsSecrets
    );
  };
}