nathan/nixpkgs
1
0
Fork 0
mirror of https://github.com/NixOS/nixpkgs.git synced 2026-08-26 02:05:02 +00:00
Code Issues Packages Projects Releases Wiki Activity

nixos.acme: fix option descriptions

Browse Source 
- replace broken links
- replace deprecated value "RFC2136_" in example with "DNSUPDATE
- warn against using legacy option "ocspMustStaple"
This commit is contained in:
git@71rd.net
2026-07-29 18:35:46 +00:00
parent 0ae2bc1419
commit d5698bf32d
1 changed files with 5 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
nixos/modules/security/acme/default.nix
View File

@@ -772,7 +772,7 @@ let
description = ''
Key type to use for private keys.
For an up to date list of supported values check the --key-type option
at <https://go-acme.github.io/lego/usage/cli/options/>.
at <https://go-acme.github.io/lego/references/ref-flags/index.html#options>.
'';
};
@@ -833,7 +833,7 @@ let
'';
example = lib.literalExpression ''
{
"RFC2136_TSIG_SECRET_FILE" = "/run/secrets/tsig-secret-example.org";
"DNSUPDATE_TSIG_SECRET_FILE" = "/run/secrets/tsig-secret-example.org";
}
'';
};
@@ -852,8 +852,9 @@ let
inherit (defaultAndText "ocspMustStaple" false) default defaultText;
description = ''
Turns on the OCSP Must-Staple TLS extension.
Make sure you know what you're doing! See:
Make sure you know what you're doing!
OCSP Must-Staple can be considered a legacy feature, that is no longer superted by Let's Encrypt. See:
- <https://letsencrypt.org/2024/12/05/ending-ocsp>
- <https://blog.apnic.net/2019/01/15/is-the-web-ready-for-ocsp-must-staple/>
- <https://blog.hboeck.de/archives/886-The-Problem-with-OCSP-Stapling-and-Must-Staple-and-why-Certificate-Revocation-is-still-broken.html>
'';