From c95e1ee6c2d80cc4cf865077119e2fc884dcf6ec Mon Sep 17 00:00:00 2001
From: Robin Appelman <robin@icewind.nl>
Date: Fri, 24 Feb 2023 20:14:23 +0100
Subject: [PATCH] nixos/acme: add option to delay renewal untill after other
 units

- allow adding additional units to the `after` section
- add documentation for delaying renewal untill after timesync is done
---
 nixos/modules/security/acme/default.md  | 16 ++++++++++++++++
 nixos/modules/security/acme/default.nix | 10 +++++++++-
 2 files changed, 25 insertions(+), 1 deletion(-)

diff --git a/nixos/modules/security/acme/default.md b/nixos/modules/security/acme/default.md
index a6ef2a3fdf18c..a3a85155e60e8 100644
--- a/nixos/modules/security/acme/default.md
+++ b/nixos/modules/security/acme/default.md
@@ -366,3 +366,19 @@ systemd-tmpfiles --create
 # Note: Do this for all certs that share the same account email address
 systemctl start acme-example.com.service
 ```
+
+
+## Delay renewing certificates until time synchronization is finished {#module-security-acme-timesync}
+
+If your machine doesn't have a correct date set at boot, the certificate renewal
+might fail.
+You can fix this issue by configuring the acme services to wait until systemd-timesyncd
+finishes synchronizing the time.
+
+```
+# install and enable systemd-time-wait-sync.service
+systemd.additionalUpstreamSystemUnits = ["systemd-time-wait-sync.service"];
+systemd.services.systemd-time-wait-sync.wantedBy = ["multi-user.target"];
+# configure the acme services to wait for systemd-time-wait-sync.service
+security.acme.defaults.after = ["time-sync.target"]
+```
diff --git a/nixos/modules/security/acme/default.nix b/nixos/modules/security/acme/default.nix
index 19297d2678519..753a9bcc4f3b2 100644
--- a/nixos/modules/security/acme/default.nix
+++ b/nixos/modules/security/acme/default.nix
@@ -334,7 +334,7 @@ let
 
     renewService = lockfileName: {
       description = "Renew ACME certificate for ${cert}";
-      after = [ "network.target" "network-online.target" "acme-fixperms.service" "nss-lookup.target" ] ++ selfsignedDeps ++ optional (cfg.maxConcurrentRenewals > 0) "acme-lockfiles.service";
+      after = [ "network.target" "network-online.target" "acme-fixperms.service" "nss-lookup.target" ] ++ selfsignedDeps ++ data.after ++ optional (cfg.maxConcurrentRenewals > 0) "acme-lockfiles.service";
       wants = [ "network-online.target" "acme-fixperms.service" ] ++ selfsignedDeps ++ optional (cfg.maxConcurrentRenewals > 0) "acme-lockfiles.service";
 
       # https://github.com/NixOS/nixpkgs/pull/81371#issuecomment-605526099
@@ -572,6 +572,14 @@ let
         description = lib.mdDoc "Group running the ACME client.";
       };
 
+      after = mkOption {
+        type = types.listOf types.str;
+        inherit (defaultAndText "after" []) default defaultText;
+        description = lib.mdDoc ''
+          List of systemd units to wait for before starting certificate renewal.
+        '';
+      };
+
       reloadServices = mkOption {
         type = types.listOf types.str;
         inherit (defaultAndText "reloadServices" []) default defaultText;