slowly getting to acme setup

modules/nginx/default.nix

@@ -2,18 +2,38 @@
   inherit (config) conf;
   inherit (lib) mkIf;
 in mkIf conf.nginx.enable {
+  security.acme = {
+    acceptTerms = true;
+    defaults.email = "mira.cp.0909@gmail.com";
+    certs = {
+      "twoneis.site" = {
+        group = "nginx";
+        extraDomainNames = [ "*.twoneis.site" ];
+        dnsProvider = "porkbun";
+        email = "mira.cp.0909@gmail.com";
+        environmentFile = "/root/porkbun-creds";
+      };
+    };
+  };
+
+  users.users.nginx.extraGroups = [ "acme" ];
+
   services.nginx = {
     enable = true;
     virtualHosts = {
-      ".twoneis.site" = {
+      default = {
         serverName = ".twoneis.site";
-        forceSSL = false;
-        locations = {
-          "/" = {
-            return = "404";
-          };
+        default = true;
+        rejectSSL = true;
+        locations."/" = {
+          return = "404";
         };
       };
     };
   };
+
+  networking.firewall.allowedTCPPorts = [
+    80
+    443
+  ];
 }