dotfiles/nixos/modules/services/acme.nix

{
  config,
  flake,
  ...
}: let
  inherit (flake.config.people) user0;
  inherit (flake.config.people.user.${user0}) email;
  inherit (flake.config.service) instance;

  domain0 = instance.web.domains.url0;
  domain1 = instance.web.domains.url1;
  dns = instance.web.dns.provider0;

  instanceName = service: (instance.${service}.subdomain);

  dnsConfig = {
    dnsProvider = dns;
    directory = instance.acme.paths.path0;
    environmentFile = config.sops.secrets."dns/namecheap".path;
  };

  domain0SubdomainNames = [
    "nextcloud"
    "jellyfin"
    "minecraft"
    "ollama"
    "syncthing"
    "vaultwarden"
  ];

  domain1SubdomainNames = [
    "wiki"
    "nextcloud"
    "castopod"
    "forgejo"
    "matrix"
    "owncast"
    "peertube"
    "writefreely"
  ];

  domainRoot = [
    domain0
    domain1
  ];

  domain0Subdomains = map instanceName domain0SubdomainNames;
  domain1Subdomains = map instanceName domain1SubdomainNames;
in {
  security.acme = {
    acceptTerms = true;
    defaults = {
      email = email.address0;
      server = "https://acme-v02.api.letsencrypt.org/directory";
    };
    certs = builtins.listToAttrs (
      (map (prefix: {
          name = "${prefix}.${domain0}";
          value = dnsConfig;
        })
        domain0Subdomains)
      ++ (map (prefix: {
          name = "${prefix}.${domain1}";
          value = dnsConfig;
        })
        domain1Subdomains)
      ++ (map (name: {
          name = name;
          value = dnsConfig;
        })
        domainRoot)
    );
  };

  sops = let
    sopsSecrets = ["pass"];
    sopsPath = secret: {
      path = "/var/lib/secrets/${instance.acme.name}/${dns}-${secret}";
      owner = "root";
      mode = "600";
    };
  in {
    secrets = builtins.listToAttrs (
      map
      (secret: {
        name = "dns/${dns}";
        value = sopsPath secret;
      })
      sopsSecrets
    );
  };
}