From 3f5a120338355081b2bbee8b82a25e753b23bcf4 Mon Sep 17 00:00:00 2001 From: Andrew Bryant Date: Mon, 28 Sep 2026 13:20:06 -0400 Subject: [PATCH] Assert against proxy.ssl with the default domain "localhost" proxy.ssl = true (the default) requests a real ACME certificate for services.hortusfox-web.domain. Left at its own default of "localhost", that request can never succeed -- Let's Encrypt won't issue for it -- but previously this only surfaced as an ACME failure at activation time. Catch it at eval time instead with a clear assertion message. Co-Authored-By: Claude Sonnet 5 --- nixos-module/default.nix | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/nixos-module/default.nix b/nixos-module/default.nix index 275c0cd..02824ce 100644 --- a/nixos-module/default.nix +++ b/nixos-module/default.nix @@ -273,6 +273,20 @@ in { }; config = lib.mkIf cfg.enable { + assertions = [ + { + assertion = !(cfg.proxy.ssl && cfg.domain == "localhost"); + message = '' + services.hortusfox-web: proxy.ssl = true (the default) requests an + ACME certificate for services.hortusfox-web.domain, but domain is + left at its own default of "localhost" -- Let's Encrypt can never + issue a certificate for that, so this would only fail at runtime. + Set domain to a real, publicly resolvable FQDN, or set + proxy.ssl = false for a local/test deployment. + ''; + } + ]; + users.users.${cfg.user} = { isSystemUser = true; group = cfg.group;