From ab3750e39438385d0fd2b596afc009be31ee9746 Mon Sep 17 00:00:00 2001
From: Mel <mel@rnrd.eu>
Date: Sun, 6 Sep 2026 21:12:57 +0200
Subject: Disable CNAME support in Lego challenge for rnrd.eu

Signed-off-by: Mel <mel@rnrd.eu>
---
 modules/foundation/www/default.nix | 23 +++++++++++++++--------
 1 file changed, 15 insertions(+), 8 deletions(-)

diff --git a/modules/foundation/www/default.nix b/modules/foundation/www/default.nix
index c84e7b4..ef1f8b0 100644
--- a/modules/foundation/www/default.nix
+++ b/modules/foundation/www/default.nix
@@ -37,15 +37,19 @@ let
     "favicon.png" = ../../../assets/favicon.png;
   };
 
-  certificate = domain: dnsProvider: credentialFiles: {
+  certificate = domain: settings: {
     ${domain} = {
       domain = "*.${domain}";
       extraDomainNames = [ domain ];
-
-      inherit dnsProvider credentialFiles;
-    };
+    } // settings;
   };
 
+  # our zones have wildcard cnames, which lego would follow to
+  # place the challenge somewhere else. keep it where it belongs.
+  noCnameFollowing = pkgs.writeText "lego-no-cname" ''
+    LEGO_DISABLE_CNAME_SUPPORT=true
+  '';
+
   # edge addresses of the cdn providers we use, to allow extraction
   # of the real addresses connecting to us.
   edgeAddresses = let
@@ -124,17 +128,20 @@ in
         # our certificates are really only used with Nginx
         group = config.services.nginx.group;
         reloadServices = [ "nginx.service" ];
+        environmentFile = noCnameFollowing;
       };
 
       # yes, we generate both certificates, even if they are not
       # used by every machine, but as long as it doesn't cause
       # any problems... :)
       certs = mergeAttrsList [
-        (certificate "rnrd.eu" "bunny" {
-          BUNNY_API_KEY_FILE = secrets.bunny-dns.path;
+        (certificate "rnrd.eu" {
+          dnsProvider = "bunny";
+          credentialFiles.BUNNY_API_KEY_FILE = secrets.bunny-dns.path;
         })
-        (certificate "rnrd.fyi" "cloudflare" {
-          CLOUDFLARE_DNS_API_TOKEN_FILE = secrets.cloudflare-dns.path;
+        (certificate "rnrd.fyi" {
+          dnsProvider = "cloudflare";
+          credentialFiles.CLOUDFLARE_DNS_API_TOKEN_FILE = secrets.cloudflare-dns.path;
         })
       ];
     };
-- 
cgit v1.3.1