refactor(haproxy): consolidate ACME configuration

Merge the ACME module into the HAProxy configuration and start HAProxy only after certificates and Tailscale connectivity are available.

systems/portal-1/haproxy/default.nix

@@ -1,7 +1,37 @@
-{ ... }:
-{
-  imports = [ ./acme.nix ];
+let
+  domains = [
+    "audiobookshelf"
+    "cache"
+    "gitea"
+    "gems"
+    "jellyfin"
+    "share"
+  ];
+  extraDomains = [ "www.norn-sight.com" ];
 
+  makeCert = name: {
+    name = "${name}.tmmworkshop.com";
+    value = {
+      webroot = "/var/lib/acme/.challenges";
+      group = "acme";
+      reloadServices = [ "haproxy.service" ];
+    };
+  };
+
+  makeExtraCert = name: {
+    inherit name;
+    value = {
+      webroot = "/var/lib/acme/.challenges";
+      group = "acme";
+      reloadServices = [ "haproxy.service" ];
+    };
+  };
+
+  acmeServices =
+    map (domain: "acme-${domain}.tmmworkshop.com.service") domains
+    ++ map (domain: "acme-${domain}.service") extraDomains;
+in
+{
   networking.firewall.allowedTCPPorts = [
     80
     443
@@ -10,8 +40,49 @@
   # Global robots.txt served by HAProxy for every vhost (see haproxy.cfg).
   environment.etc."haproxy/robots.txt".source = ./robots.txt;
 
-  services.haproxy = {
-    enable = true;
-    config = builtins.readFile ./haproxy.cfg;
+  services = {
+    haproxy = {
+      enable = true;
+      config = builtins.readFile ./haproxy.cfg;
+    };
+    nginx = {
+      enable = true;
+      virtualHosts."acme-challenge" = {
+        listen = [
+          {
+            addr = "127.0.0.1";
+            port = 8402;
+          }
+        ];
+        locations."/.well-known/acme-challenge/" = {
+          root = "/var/lib/acme/.challenges";
+        };
+      };
+    };
+  };
+
+  security.acme = {
+    acceptTerms = true;
+    defaults.email = "Richie@tmmworkshop.com";
+    certs = builtins.listToAttrs ((map makeCert domains) ++ (map makeExtraCert extraDomains));
+  };
+
+  systemd = {
+    services.haproxy = {
+      # HAProxy needs the initial certificates and Tailscale connectivity before
+      # it can serve requests to its backends.
+      after = acmeServices ++ [ "tailscaled-autoconnect.service" ];
+      wants = acmeServices ++ [ "tailscaled-autoconnect.service" ];
+    };
+    tmpfiles.rules = [
+      "d /var/lib/acme/.challenges 0750 acme acme - -"
+      "d /var/lib/acme/.challenges/.well-known 0750 acme acme - -"
+      "d /var/lib/acme/.challenges/.well-known/acme-challenge 0750 acme acme - -"
+    ];
+  };
+
+  users.users = {
+    haproxy.extraGroups = [ "acme" ];
+    nginx.extraGroups = [ "acme" ];
   };
 }