slowly getting to acme setup

modules/nginx/default.nix

@@ -2,18 +2,38 @@
   inherit (config) conf;
   inherit (lib) mkIf;
 in mkIf conf.nginx.enable {
+  security.acme = {
+    acceptTerms = true;
+    defaults.email = "mira.cp.0909@gmail.com";
+    certs = {
+      "twoneis.site" = {
+        group = "nginx";
+        extraDomainNames = [ "*.twoneis.site" ];
+        dnsProvider = "porkbun";
+        email = "mira.cp.0909@gmail.com";
+        environmentFile = "/root/porkbun-creds";
+      };
+    };
+  };
+
+  users.users.nginx.extraGroups = [ "acme" ];
+
   services.nginx = {
     enable = true;
     virtualHosts = {
-      ".twoneis.site" = {
+      default = {
         serverName = ".twoneis.site";
-        forceSSL = false;
+        default = true;
-        locations = {
+        rejectSSL = true;
-          "/" = {
+        locations."/" = {
-            return = "404";
+          return = "404";
-          };
         };
       };
     };
   };
+
+  networking.firewall.allowedTCPPorts = [
+    80
+    443
+  ];
 }

modules/website/default.nix

@@ -5,7 +5,8 @@ in mkIf conf.website.enable {
   services.nginx.virtualHosts = {
     "twoneis.site" = {
       serverName = "twoneis.site";
-      forceSSL = false;
+      useACMEHost = "twoneis.site";
+      forceSSL = true;
       locations = {
         "/" = {
           return = "200 \"faggot\"";
@@ -13,8 +14,4 @@ in mkIf conf.website.enable {
       };
     };
   };
-
-  networking.firewall.allowedTCPPorts = [
-    80
-  ];
 }