reconfigure soju

1 files changed, 65 insertions, 3 deletions

diff --git a/hosts/cloud/irc.nix b/hosts/cloud/irc.nix
index d39a2e9..18789e6 100644
--- a/hosts/cloud/irc.nix
+++ b/hosts/cloud/irc.nix
@@ -1,12 +1,74 @@
-{ pkgs, ... }:
+{ pkgs, config, lib, ... }:
+let
+  domain = "bnc.oxapentane.com";
+  certDir = config.security.acme.certs.${domain}.directory;
+in
 {
+  # so soju can read the cert
+  users.groups.soju-tls = {};
+
+  sops.secrets = {
+    mythicbeasts-acme-bnc-api = {
+      owner = "root";
+      group = "root";
+      mode = "0400";
+    };
+    mythicbeasts-acme-bnc-api-secret = {
+      owner = "root";
+      group = "root";
+      mode = "0400";
+    };
+  };
+
+  # get the cert via DNS
+  security.acme = {
+    acceptTerms = true;
+    certs.${domain} = {
+      dnsProvider = "mythicbeasts";
+      credentialFiles = {
+        "MYTHICBEASTS_USERNAME_FILE" = config.sops.secrets.mythicbeasts-acme-bnc-api.path;
+        "MYTHICBEASTS_PASSWORD_FILE" = config.sops.secrets.mythicbeasts-acme-bnc-api-secret.path;
+      };
+      group = "soju-tls";
+      reloadServices = [
+        "soju.service"
+      ];
+    };
+  };
+
+  # open port
+  networking.firewall.allowedTCPPorts = [
+    6697
+  ];
+
+  # soju config
   services.soju = {
     enable = true;
+    hostName = domain;
     listen = [
-      "irc+insecure://10.89.87.1"
-      "irc+insecure://[fd31:185d:722e::1]"
+      "ircs://:6697"
     ];
+
+    tlsCertificate = "${certDir}/fullchain.pem";
+    tlsCertificateKey = "${certDir}/key.pem";
+
+    adminSocket.enable = true;
+    enableMessageLogging = true;
   };
 
+  systemd.services.soju = {
+    wants = [ "acme-${domain}.service" ];
+    after = [ "acme-${domain}.service" ];
+    serviceConfig.SupplementaryGroups = [ "soju-tls" ];
+  };
+
+  # make sure that creds are there, before contacting letsencrypt
+  systemd.services."acme-order-renew-${domain}" =
+    lib.mkIf config.sops.useSystemdActivation
+      {
+        requires = [ "sops-install-secrets.service" ];
+        after = [ "sops-install-secrets.service" ];
+      };
+
   environment.systemPackages = [ pkgs.soju ];
 }