nixos/acme: add option to delay renewal untill after other units

- allow adding additional units to the `after` section
- add documentation for delaying renewal untill after timesync is done

nixos/modules/security/acme/default.md

@@ -366,3 +366,19 @@ systemd-tmpfiles --create
 # Note: Do this for all certs that share the same account email address
 systemctl start acme-example.com.service
 ```
+
+
+## Delay renewing certificates until time synchronization is finished {#module-security-acme-timesync}
+
+If your machine doesn't have a correct date set at boot, the certificate renewal
+might fail.
+You can fix this issue by configuring the acme services to wait until systemd-timesyncd
+finishes synchronizing the time.
+
+```
+# install and enable systemd-time-wait-sync.service
+systemd.additionalUpstreamSystemUnits = ["systemd-time-wait-sync.service"];
+systemd.services.systemd-time-wait-sync.wantedBy = ["multi-user.target"];
+# configure the acme services to wait for systemd-time-wait-sync.service
+security.acme.defaults.after = ["time-sync.target"]
+```

nixos/modules/security/acme/default.nix

@@ -334,7 +334,7 @@ let
 
     renewService = lockfileName: {
       description = "Renew ACME certificate for ${cert}";
-      after = [ "network.target" "network-online.target" "acme-fixperms.service" "nss-lookup.target" ] ++ selfsignedDeps ++ optional (cfg.maxConcurrentRenewals > 0) "acme-lockfiles.service";
+      after = [ "network.target" "network-online.target" "acme-fixperms.service" "nss-lookup.target" ] ++ selfsignedDeps ++ data.after ++ optional (cfg.maxConcurrentRenewals > 0) "acme-lockfiles.service";
       wants = [ "network-online.target" "acme-fixperms.service" ] ++ selfsignedDeps ++ optional (cfg.maxConcurrentRenewals > 0) "acme-lockfiles.service";
 
       # https://github.com/NixOS/nixpkgs/pull/81371#issuecomment-605526099
@@ -572,6 +572,14 @@ let
         description = lib.mdDoc "Group running the ACME client.";
       };
 
+      after = mkOption {
+        type = types.listOf types.str;
+        inherit (defaultAndText "after" []) default defaultText;
+        description = lib.mdDoc ''
+          List of systemd units to wait for before starting certificate renewal.
+        '';
+      };
+
       reloadServices = mkOption {
         type = types.listOf types.str;
         inherit (defaultAndText "reloadServices" []) default defaultText;