For the acme question, indeed I see now this:
Aug 11 22:16:05 rpi acme-biscotty.online-start[70606]: 2023/08/11 22:16:05 Could not obtain certificates:
Aug 11 22:16:05 rpi acme-biscotty.online-start[70606]: error: one or more domains had a problem:
Aug 11 22:16:05 rpi acme-biscotty.online-start[70606]: [biscotty.online] acme: error: 400 :: urn:ietf:params:acme:error:connection :: 76.127.10.154: Fetching http://biscotty.online/.well-known/acme-challenge/RnDJEmRoI92nTqmTWuRAW2ydG2Tq2DkVI5airH_V8-E: Timeout after connect (your server may be slow or overloaded)
Aug 11 22:16:06 rpi acme-biscotty.online-start[70598]: + echo Failed to fetch certificates. This may mean your DNS records are set up incorrectly. Selfsigned certs are in place and dependant services will still start.
Aug 11 22:16:06 rpi acme-biscotty.online-start[70598]: Failed to fetch certificates. This may mean your DNS records are set up incorrectly. Selfsigned certs are in place and deacme.txt
but the domain uses the default nameservers of the domain name provider (name.com), and in actual practice the domain resolves correctly.
You won’t. In the NixOS world, services are configured using the NixOS module system, i.e. in your configuration.nix. If you want to manually add things to your nginx config you use services.nginx.appendConfig … You can use the NixOS module system (and especially the cool virtualHost options) instead for organization.
I thought the answer would be like this. (Hoping, actually.) Where can I find human-readable documentation on nginx.appendConfig and using virtualHost options? Going to the link reminds me of the first time I looked at a man page lol. Is there a place where I could see an example or 2?
Adding it manually shouldn’t be required, you’ll notice multiple “server” sections, one of which should be listening on :443 for that domain (if not, your virtualHost may be missing some options, but I’m almost certain you just overlooked it).
Indeed netstat shows nginx listening on 443, though there really is only 1 server block in the config file.
pid /run/nginx/nginx.pid;
error_log stderr;
daemon off;
events {
}
http {
include /nix/store/80fh5a5lh89bg60xs9a6a2230i0rnc5c-mailcap-2.1.53/etc/nginx/mime.types;
types_hash_max_size 4096;
include /nix/store/rmjzvb9qa511szqri9rm8256ashk5rhs-nginx-1.24.0/conf/fastcgi.conf;
include /nix/store/rmjzvb9qa511szqri9rm8256ashk5rhs-nginx-1.24.0/conf/uwsgi_params;
default_type application/octet-stream;
ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;
# $connection_upgrade is used for websocket proxying
map $http_upgrade $connection_upgrade {
default upgrade;
'' close;
}
client_max_body_size 10m;
server_tokens off;
server {
listen 0.0.0.0:80 ;
listen [::0]:80 ;
server_name biscotty.me ;
root /var/www/biscotty.me;
}
}
In configuration.nix I have.
services.nginx.virtualHosts."biscotty.online" = {
addSSL = true;
enableACME = true;
root = "/var/lib/www/biscotty.online";
};
It must be the addSSL line that makes nginx listen on 443? And the second that creates the acme user and associated directories, yes?