Pass to ACME email from a secret

Help
1 
{config, lib, ...}: {
  vaultix.secrets.acmeMailUser = {
    file = config.module.secrets.mail.StmpHostPath;
    mode = "0400";
    owner = "acme";
    group = "acme";
  };

  security.acme = {
    acceptTerms = true;
    defaults.email = lib.trim (builtins.readFile config.vaultix.secrets.acmeMailUser.file);
    defaults.group = "acme";

    certs."${config.networking.domain}" = {
      domain = "${config.networking.domain}";
      extraDomainNames = ["*.${config.networking.domain}"];
    };
  };
}

This is my current config for now, who, obviously don’t work (the lego command pas a bunch of junk as the --email flag), my secret contain exacly email@exemple.org .

I don’t have really a good idea to how to do it, other than just hardcode my email on the config, but remove all the interest to have it centralize on one single place.

I’m not really interest on avoid it to have my email on the nix store, can be a nice touch, but after all if someone really want it, they gonna find it (without even needing to read my nix store)

2

builtins.readFile is an evaluation time function so even if it was able to read the file containing your email, using it would copy your email to the nix store. I’m not familiar with vaultix, but you might be reading the encrypted file.

It depends on which CA you’re using, however some CAs (particularly Let’s Encrypt) don’t require any email.

3

I know that builtins.readFile don’t gonna work, since the secret need to be read at runtime time, and not evaluation time.

On this usage, vaultix is really similar at agenix, pass a path to a file on /run that is readable (here) only by acme

the issue is that this thing don’t work to read it a runtime, wich make it not working

4

Unless you’ve changed the ACME server used from the default of Let’s Encrypt, you do not need to set the email.

Let’s Encrypt do not store or use your email for any purpose (Ending Support for Expiration Notification Emails - Let's Encrypt).

5

Even if it’s a temporay solution, indeed i use Let’s Encrypt, i don’t want to resume on this solution, since i can, one day want to change where come from my certificate and that can become a issue

6

You can set environmentFile to point to a file setting LEGO_EMAIL e.g.

LEGO_EMAIL=example@example.org
1 Like
7 
{config, ...}: {
  vaultix.secrets.preAcmeMailUser = {
    file = config.module.secrets.mail.UsernamePath;
    mode = "0400";
    owner = "root";
    group = "root";
  };

  security.acme = {
    acceptTerms = true;
    defaults.email = "noreply@wateir.fr";
    defaults.group = "acme";

    certs."${config.networking.domain}" = {
      domain = "${config.networking.domain}";
      extraDomainNames = ["*.${config.networking.domain}"];
      environmentFile = config.vaultix.templates.acmeEnv.path;
    };
  };

  vaultix.templates.acmeEnv = {
    content = ''
      LEGO_EMAIL=${config.vaultix.secrets.preAcmeMailUser.file}
    '';
    name = "acmeEnv";
    owner = "acme";
    group = "acme";
    mode = "0400";
  };
}

Whole solution for people who come across this post