From 048863593a21a22b6f80d9583d5890504bc5a01d Mon Sep 17 00:00:00 2001
From: Sebastien Bourdeauducq <sb@m-labs.hk>
Date: Mon, 4 Jul 2022 16:22:40 +0800
Subject: [PATCH] nixbld: remove obsolete ACME workaround

---
 nixbld-etc-nixos/configuration.nix | 51 ++++++++----------------------
 1 file changed, 14 insertions(+), 37 deletions(-)

diff --git a/nixbld-etc-nixos/configuration.nix b/nixbld-etc-nixos/configuration.nix
index ce7fc29..29ed663 100644
--- a/nixbld-etc-nixos/configuration.nix
+++ b/nixbld-etc-nixos/configuration.nix
@@ -543,29 +543,7 @@ in
 
   security.acme.acceptTerms = true;
   security.acme.defaults.email = "sb" + "@m-labs.hk";
-  security.acme.certs = {
-    "nixbld.m-labs.hk" = {
-      group = "nginx";
-      webroot = "/var/lib/acme/acme-challenge";
-      extraDomainNames = [
-        "m-labs.hk"
-        "www.m-labs.hk"
-        "conda.m-labs.hk"
-        "lab.m-labs.hk"
-        "git.m-labs.hk"
-        "chat.m-labs.hk"
-        "hooks.m-labs.hk"
-        "forum.m-labs.hk"
-        "perso.m-labs.hk"
-        "call.m-labs.hk"
-        "rt.m-labs.hk"
-        "nmigen.org"
-        "www.nmigen.org"
-        "m-labs.science"
-        "www.m-labs.science"
-      ];
-    };
-  };
+
   # https://github.com/NixOS/nixpkgs/issues/106862
   systemd.services."acme-fixperms".wants = [ "bind.service" "dnsmasq.service" ];
   systemd.services."acme-fixperms".after = [ "bind.service" "dnsmasq.service" ];
@@ -576,7 +554,7 @@ in
     virtualHosts = let
       mainWebsite = {
         addSSL = true;
-        useACMEHost = "nixbld.m-labs.hk";
+        enableACME = true;
         root = "${hydraWwwOutputs}/web";
         extraConfig = ''
           error_page 404 /404.html;
@@ -655,7 +633,7 @@ in
       "www.m-labs.science" = mainWebsite;
       "lab.m-labs.hk" = {
         forceSSL = true;
-        useACMEHost = "nixbld.m-labs.hk";
+        enableACME = true;
         locations."/munin/".alias = "/var/www/munin/";
         locations."/munin".extraConfig = ''
           auth_basic "Munin";
@@ -670,12 +648,12 @@ in
       };
       "nixbld.m-labs.hk" = {
         forceSSL = true;
-        useACMEHost = "nixbld.m-labs.hk";
+        enableACME = true;
         locations."/".proxyPass = "http://127.0.0.1:3000";
       };
       "conda.m-labs.hk" = {
         forceSSL = true;
-        useACMEHost = "nixbld.m-labs.hk";
+        enableACME = true;
         locations."/artiq-beta/" = {
           alias = "${hydraWwwOutputs}/artiq-conda-channel-beta/";
           extraConfig = ''
@@ -707,7 +685,7 @@ in
       };
       "git.m-labs.hk" = {
         forceSSL = true;
-        useACMEHost = "nixbld.m-labs.hk";
+        enableACME = true;
         locations."/".proxyPass = "http://127.0.0.1:3001";
         extraConfig = ''
           client_max_body_size 300M;
@@ -715,14 +693,14 @@ in
       };
       "chat.m-labs.hk" = {
         forceSSL = true;
-        useACMEHost = "nixbld.m-labs.hk";
+        enableACME = true;
         locations."/".proxyPass = "http://127.0.0.1:8065";
         locations."~ /api/v[0-9]+/(users/)?websocket$".proxyPass = "http://127.0.0.1:8065";
         locations."~ /api/v[0-9]+/(users/)?websocket$".proxyWebsockets = true;
       };
       "hooks.m-labs.hk" = {
         forceSSL = true;
-        useACMEHost = "nixbld.m-labs.hk";
+        enableACME = true;
         locations."/mattermost-github".extraConfig = ''
           include ${pkgs.nginx}/conf/uwsgi_params;
           uwsgi_pass unix:${config.services.uwsgi.runDir}/uwsgi-mgi.sock;
@@ -734,7 +712,7 @@ in
       };
       "forum.m-labs.hk" = {
         forceSSL = true;
-        useACMEHost = "nixbld.m-labs.hk";
+        enableACME = true;
         root = "/var/www/flarum/public";
         locations."~ \.php$".extraConfig = ''
           fastcgi_pass unix:${config.services.phpfpm.pools.flarum.socket};
@@ -746,18 +724,17 @@ in
         '';
       };
       "call.m-labs.hk" = {
-        useACMEHost = "nixbld.m-labs.hk";
-        enableACME = false;
         forceSSL = true;
+        enableACME = true;
       };
       "perso.m-labs.hk" = {
         addSSL = true;
-        useACMEHost = "nixbld.m-labs.hk";
+        enableACME = true;
         root = "/var/www/perso";
       };
       "rt.m-labs.hk" = {
         forceSSL = true;
-        useACMEHost = "nixbld.m-labs.hk";
+        enableACME = true;
         locations."/" = {
           proxyPass = "http://127.0.0.1:4201";
           extraConfig = ''
@@ -779,14 +756,14 @@ in
       };
       "nmigen.org" = {
         addSSL = true;
-        useACMEHost = "nixbld.m-labs.hk";
+        enableACME = true;
         locations."/".extraConfig = ''
           return 307 https://m-labs.hk/gateware/nmigen/;
         '';
       };
       "www.nmigen.org" = {
         addSSL = true;
-        useACMEHost = "nixbld.m-labs.hk";
+        enableACME = true;
         locations."/".extraConfig = ''
           return 307 https://m-labs.hk/gateware/nmigen/;
         '';