nixos/acme: Allow using lego's built-in web server

[deviant]

Motivation for this change

Currently, we hardcode the use of --http.webroot, even if no webroot is
configured. This has the effect of disabling the built-in server.

Things done

• Tested using sandboxing (nix.useSandbox on NixOS, or option sandbox in nix.conf on non-NixOS linux)
• Built on platform(s)
  • NixOS
  • macOS
  • other Linux distributions
• Tested via one or more NixOS test(s) if existing and applicable for the change (look inside nixos/tests)
• Tested compilation of all pkgs that depend on this change using nix-shell -p nixpkgs-review --run "nixpkgs-review wip"
• Tested execution of all binary files (usually in ./result/bin/)
• Added a release notes entry if the change is major or breaking
• Fits CONTRIBUTING.md.

[deviant]

This isn't a very complex change, but mentioning @NixOS/acme regardless since I don't think that happens automatically.

[emilazy]

see also #88531 (thanks(?) stale bot)

[deviant]

see also #88531 (thanks(?) stale bot)

Ugh, I swear I searched for this but couldn't find anything related

[emilazy]

It’d be good to include the AmbientCapabilities change and I’m ambivalent about the difference in configuration, so I didn’t mean you should close this one, merely wanted to link the two :)

[m1cr0man]

Infact Deviant, if you were to pull the proposed listenHTTP from that PR into this one we could see about getting it merged since you're active (at least right now). I'm not of any first-in, first-out ruling here.

[deviant]

Yep, I'll look at combining the two in a bit once I'm not busy

[deviant]

There. The patch now incorporates the functionality of #88531, and thus supersedes it.

Heads up: I've not tested this version, although I believe it should work.

[deviant]

Does this require further changes, or is it okay as-is?

[m1cr0man]

I had to double check what --http.port accepts but this looks good :) Nice one on the AmbientCapabilities too.

[deviant]

@mweinelt @m1cr0man @emilazy bump

[m1cr0man]

I'm still good for a merge on this and infact I'm gonna say it'll block #147784 . This PR has been around long enough that the work to rebase should fall on me in that other PR. I'll also add a test too.

[deviant]

Thanks!

[nixos-discourse]

This pull request has been mentioned on NixOS Discourse. There might be relevant details there:

https://discourse.nixos.org/t/problem-with-security-acme-and-listenhttp-option/16790/5