Unverified Commit af4ba816 authored by pennae's avatar pennae Committed by GitHub
Browse files

Merge pull request #308303 from Lynnaut/nginx-acme 

nixos/nginx: don't add .well-known locations for acme when using DNS-01
parents cadb9fc5 a586e82e

nixos/modules/services/web-servers/nginx/default.nix

+2 −1
Original line number Diff line number Diff line
@@ -352,7 +352,8 @@ let 


        # The acme-challenge location doesn't need to be added if we are not using any automated

        # certificate provisioning and can also be omitted when we use a certificate obtained via a DNS-01 challenge

        acmeLocation = optionalString (vhost.enableACME || (vhost.useACMEHost != null && config.security.acme.certs.${vhost.useACMEHost}.dnsProvider == null))

        acmeName = if vhost.useACMEHost != null then vhost.useACMEHost else vhostName;

        acmeLocation = optionalString ((vhost.enableACME || vhost.useACMEHost != null) && config.security.acme.certs.${acmeName}.dnsProvider == null)

          # Rule for legitimate ACME Challenge requests (like /.well-known/acme-challenge/xxxxxxxxx)

          # We use ^~ here, so that we don't check any regexes (which could

          # otherwise easily override this intended match accidentally).