My nix-darwin and NixOS config
fix: add correct service
+15
-12
+15
-12
scripts/fix-acme-cert.sh
+15
-12
scripts/fix-acme-cert.sh
···
9
9
CERT_DIR="/var/lib/acme/ewancroft.uk"
10
10
SECRET_PATH="/run/secrets/cloudflare-acme.env"
11
11
ACME_SERVICE="acme-ewancroft.uk.service"
12
+
ACME_ORDER_SERVICE="acme-order-renew-ewancroft.uk.service"
12
13
FLAKE="/home/ewan/.config/nix-config#server"
13
14
14
15
RED='\033[0;31m'
···
133
134
fi
134
135
135
136
# ─────────────────────────────────────────────────────────────────────────────
136
-
header "6d. Triggering ACME (systemctl clean + start)"
137
+
header "6d. Triggering ACME order/renew service"
137
138
# ─────────────────────────────────────────────────────────────────────────────
138
-
# systemctl clean --what=state is the official NixOS method: it removes the
139
-
# cert dir AND the lego accounts/state directory so the next start is a full
140
-
# fresh run rather than a renewal.
141
-
info "Cleaning all ACME state (official NixOS method)..."
142
-
systemctl clean --what=state "$ACME_SERVICE"
139
+
# acme-order-renew-ewancroft.uk.service is the unit that actually runs lego.
140
+
# Stop the preliminary service first so systemctl clean can proceed.
141
+
info "Stopping preliminary service..."
142
+
systemctl stop "$ACME_SERVICE" 2>/dev/null || true
143
+
info "Cleaning ACME state..."
144
+
systemctl clean --what=state "$ACME_SERVICE" 2>/dev/null || true
145
+
systemctl clean --what=state "$ACME_ORDER_SERVICE" 2>/dev/null || true
143
146
ok "State cleaned"
144
147
145
-
info "Starting $ACME_SERVICE — this may take ~30–90s (DNS propagation)..."
148
+
info "Starting $ACME_ORDER_SERVICE — this may take ~30–90s (DNS propagation)..."
146
149
START_TIME=$(date --iso-8601=seconds)
147
-
if systemctl start "$ACME_SERVICE"; then
148
-
ok "ACME service completed successfully"
150
+
if systemctl start "$ACME_ORDER_SERVICE"; then
151
+
ok "ACME order service completed successfully"
149
152
else
150
-
fail "ACME service failed"
153
+
fail "ACME order service failed"
151
154
echo ""
152
155
echo " Full journal for this run:"
153
-
journalctl -u "$ACME_SERVICE" --since "$START_TIME" --no-pager
156
+
journalctl -u "$ACME_ORDER_SERVICE" --since "$START_TIME" --no-pager
154
157
die "See journal output above for the root cause"
155
158
fi
156
159
157
160
info "Journal output from this run:"
158
-
journalctl -u "$ACME_SERVICE" --since "$START_TIME" --no-pager
161
+
journalctl -u "$ACME_ORDER_SERVICE" --since "$START_TIME" --no-pager
159
162
160
163
# ─────────────────────────────────────────────────────────────────────────────
161
164
header "7. Verifying new cert"