Lots of updates to try and get ACME working

hosts/genesis/acme.nix

@@ -0,0 +1,62 @@
+{ pkgs, config, lib, ... }:
+
+let
+	address = (builtins.elemAt config.networking.interfaces.ens18.ipv4.addresses 0).address;
+	root_ca = pkgs.writeText "root_ca.crt" (builtins.readFile ../../ca/root_ca.crt);
+	intermediate_ca = pkgs.writeText "intermediate_ca.crt" (builtins.readFile ../../ca/intermediate_ca.crt);
+in {
+	age.secrets.acme_password = {
+		file = ../../secrets/acme_password.age;
+	};
+	age.secrets.intermediate_ca_key = {
+		file = ../../secrets/ca/intermediate_key.age;
+	};
+	age.secrets.root_ca_key.file = ../../secrets/ca/root_key.age;
+	systemd.services.step-ca.serviceConfig.Environment = lib.mkForce ["STEPDEBUG=1" "HOME=%S/step-ca"];
+	services.step-ca = {
+		inherit address;
+		enable = true;
+		intermediatePasswordFile = config.age.secrets.acme_password.path;
+		openFirewall = true;
+		port = 8443;
+		settings = {
+			root = root_ca;
+			federatedRoots = null;
+			cert = intermediate_ca;
+			key = config.age.secrets.intermediate_ca_key.path;
+			dnsNames = [
+				"10.42.1.5"
+				"acme.thehellings.lan"
+			];
+			logger.format = "text";
+			db = {
+				type = "badgerv2";
+				dataSource = "/var/lib/step-ca/db";
+				badgerFileLoadingMode = "";
+			};
+			authority.provisioners = [ {
+				type = "JWK";
+				name = "greg@thehellings.com";
+				key = {
+					use = "sig";
+					kty = "EC";
+					kid = "1GOpOttYLZtx7XiG79ZycbGcG4ptL0czfohK35SZOEI";
+					crv = "P-256";
+					alg = "ES256";
+					x = "YEWVj5CCoqWQXWqmL0UuORlFY9IEOLcg1jpG1o-wGx4";
+					y = "MEpqnJp60VV-SpFtb6m8U-VAYut7R_PKFm07xl7MjBk";
+				};
+				encryptedKey = "eyJhbGciOiJQQkVTMi1IUzI1NitBMTI4S1ciLCJjdHkiOiJqd2sranNvbiIsImVuYyI6IkEyNTZHQ00iLCJwMmMiOjYwMDAwMCwicDJzIjoieWdfb0lfbWgwbHhPRXdjUTBsd0FnUSJ9.ivdQUFEhs2U8PUBYr8AhQl3hHdb4spF4jvXgqY_hiVgpjB-z3Nn9Uw.u7vrNht_3WD1G97q.mbydlpAQxjtKLkOmmDOUczqscRDPqrUyoPJ1uqXcJDH3vs4KiYlrKRcFLjPy9sWzEL1iIrqjwf3U-3AAx1KNAg7frs2D__MGfOO-U5SdQDVJVAND7KpWOJGJVSb0xioCA6-8ldlP_REqu4ENmkkdw0_6Is2b0p7ZFKqke_fqOOs7osqFAfbMb_WzEWrACLn5A5-Teh2rpEgR-z9zipN6MSEqE6VIQ2BXuv70aHWhslNe1MK1OgTYm9CqA47EMYvQ7HQLPDZAbP56WK84yJLktoXMmnkaKeTtvER0dh4ufyjJHBhecnEranbR5rHc_jV8_qvyWhlqbCrOU_8bWrk.a9SH_q3GKIUsOUSRWkDxQg";
+			} ];
+			tls = {
+				cipherSuites = [
+					"TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256"
+					"TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256"
+				];
+				minVersion = 1.2;
+				maxVersion = 1.3;
+				renegotiation = false;
+			};
+		};
+	};
+}

hosts/genesis/adblockUpdate.sh

@@ -2,6 +2,7 @@
 set -ex
 
 curl -s https://raw.githubusercontent.com/StevenBlack/hosts/master/hosts | sed '1,33d' > /etc/adblock_hosts
+curl -s https://adaway.org/hosts.txt | sed '1,24d' | sed 's/127.0.0.1/0.0.0.0/' >> /etc/adblock_hosts
 
 # Custom domains that I need to preserve for some reason
 for f in "segment.com" "segment.io" "branch.io" "dev.visualwebsiteoptimizer.com"; do

hosts/genesis/default.nix

@@ -7,6 +7,7 @@
 {
 	imports = [
 		# Include the results of the hardware scan.
+		./acme.nix
 		./hardware-configuration.nix
 		./home-assistant.nix
 		./networking.nix
@@ -34,6 +35,7 @@
 	environment.systemPackages = with pkgs; [
 		awscli2
 		create_ssl
+		step-ca
 	];
 
 	virtualisation.oci-containers.containers.speedtest = {

hosts/genesis/home-assistant.nix

@@ -87,6 +87,7 @@ in
 			];
 			environment = {
 				TZ = "America/Chicago";
+				CONSOLE_OUTPUT = "true";
 			};
 		};
 	};