security.acme

[qknight]

Issue description

we are creating security.acme records from two modules:

• nixcloud.email
• nixcloud-webservices

my original idea was that they could share the certificates but the security.acme won't merge my configurations and bails out with:

config from module a

    "example.com" = {
      webroot = "/var/lib/acme/acme-challenge";
      domain = "example.com";
      extraDomains = { "lastlog.de" = null; };
    };
  };

config from module b

    "example.com" = {
      webroot = "/var/lib/acme/acme-challenge";
      domain = "example.com";
    };
  };

the error message

nix-repl> :p config.security.acme.certs."example.com"
{ _module = { args = { name = "example.com"; }; check = true; }; allowKeysForGroup = false; domain = «error: The unique option `security.acme.certs.example.com.domain' is defined multiple times, in `/etc/nixos/configuration.nix' and `/h}

question & current solution

i wonder if certificate sharing can even work with the way security.acme is designed at the moment.

so for now, until someone can teach me otherwise, i will just issue a new certificate per abstraction which means:

• more certificates to handle
• faster exceeding or using up the certificate pool (let's encrypt issues 4/week for a single domain IIRC)

[zimbatm]

agreed this is weird, I would expect the submodule to recursively merge.

[zimbatm]

the answer is probably somewhere in here:

nixpkgs/lib/types.nix

Lines 263 to 269 in 71631a9

	merge = loc: defs:
	mapAttrs (n: v: v.value) (filterAttrs (n: v: v ? value) (zipAttrsWith (name: defs:
	(mergeDefinitions (loc ++ [name]) elemType defs).optionalValue
	)
	# Push down position info.
	(map (def: listToAttrs (mapAttrsToList (n: def':
	{ name = n; value = { inherit (def) file; value = def'; }; }) def.value)) defs)));

the submodule system is quite hard to read

[qknight]

@zimbatm thanks for your insight. (just wanted to point this out and see if i was right or missed something).

[qknight]

@zimbatm i've figured out what is going on in the mergin issue:

with this code i was able to merge the 'domain' properly.

  myDomain = mkOptionType {
    name = "myDomain";
    merge = mergeEqualOption;
  };
...
  certOpts = { name, ... } @ toplevel: {
    options = {
      domain = mkOption {
        type = myDomain;
        description = "Domain to fetch certificate for (defaults to the entry name)";
      };

**note: **

• mergeEqualOption can be found in <nixpkgs>/lib/options.nix and is used by types.bool
• other attributes, as email for instance, also need this 'special' type to merge correctly