use wildcard cert

homelab-services/minio-service/flake.nix

@@ -183,8 +183,8 @@ EOF
             enable = true;
             virtualHosts.${opts.default-nginx.hostname} = {
               forceSSL = true;
-              enableACME = true;
-              acmeRoot = null;
+              # Parse TLD from hostname to use wildcard cert
+              useACMEHost = (domain: let parts = lib.strings.split "." domain; len = builtins.length parts; in if len>=2 then lib.strings.concatStringsSep "." (lib.lists.drop (len - 2) parts) else domain) "${opts.default-nginx.hostname}";
 
               # This does not work even with the MINIO_BROWSER_REDIRECT_URL set
               locations."/console" = {

nixos/configuration.nix

@@ -51,7 +51,7 @@
   security.acme = {
     acceptTerms = true;
     defaults = {
-      # use staging testing
+      # use staging for testing
       server = "https://acme-staging-v02.api.letsencrypt.org/directory";
       # use prod for deploy
       # server = "https://acme-v02.api.letsencrypt.org/directory";