{ ... }:

# Shared ACME (Let's Encrypt) infrastructure for services that need their own
# certificate rather than being fronted by Caddy - currently just AdGuard
# Home's DNS-over-HTTPS/DNS-over-TLS listener (modules/adguard.nix), which
# terminates TLS itself on its own ports rather than through Caddy.
#
# Challenge type: HTTP-01 via a shared webroot that Caddy serves on port 80
# for dns.karanj.com (see modules/caddy.nix) - no DNS provider API
# credentials needed. This is a separate Let's Encrypt certificate from the
# one Caddy obtains for its own reverse-proxied HTTPS on the same domain;
# issuing two independent certs for one domain is fine and well within
# Let's Encrypt's rate limits.
{
  security.acme = {
    acceptTerms = true;
    defaults.email = "me@karanj.com";

    certs."dns.karanj.com" = {
      webroot = "/var/lib/acme/acme-challenge";
      # Owns the issued cert/key files by the adguardhome group so the
      # service can read them without running as root.
      group = "adguardhome";
      # Restart (not just reload) so AdGuard re-reads the cert on renewal.
      reloadServices = [ "adguardhome.service" ];
    };
  };

  # Make sure Caddy (which serves the HTTP-01 webroot) is already up before
  # the first issuance attempt.
  systemd.services."acme-dns.karanj.com".after = [ "caddy.service" ];
}