lego: 4.8.0 -> 4.9.0

[esclear]

Description of changes

Changelog

Things done

• Built on platform(s)
  • x86_64-linux
  • aarch64-linux
  • x86_64-darwin
  • aarch64-darwin
• For non-Linux: Is sandbox = true set in nix.conf? (See Nix manual)
• Tested, as applicable:
  • NixOS test(s) (look inside nixos/tests)
  • and/or package tests
  • or, for functions and "core" functionality, tests in lib/tests or pkgs/test
  • made sure NixOS tests are linked to the relevant packages
• Tested compilation of all packages that depend on this change using nix-shell -p nixpkgs-review --run "nixpkgs-review rev HEAD". Note: all changes have to be committed, also see nixpkgs-review usage
• Tested basic functionality of all binary files (usually in ./result/bin/)
• 22.11 Release Notes (or backporting 22.05 Release notes)
  • (Package updates) Added a release notes entry if the change is major or breaking
  • (Module updates) Added a release notes entry if the change is significant
  • (Module addition) Added a release notes entry if adding a new NixOS module
  • (Release notes changes) Ran nixos/doc/manual/md-to-db.sh to update generated release notes
• Fits CONTRIBUTING.md.

[m1cr0man]

Built (via rebase) against #191861. Don't see anything in the change log to be concerned about. Happy to merge 🙂

[rien]

Hi, it seems that this update broke ACME in my particular setup (wildcard cert, DNS-01 with CNAME's). Apparently a known issue: go-acme/lego#1710

I'll try to look for a fix.

[m1cr0man]

You could potentially disable the dnsPropagationCheck in the mean time, assuming your provider instantly sets new records. Otherwise yeah you might have to wait. If you can figure out a patch for lego itself you could inject and build that in NixOS too using an overlay.

[rien]

I've tried that fix just now, and it does not seem to work.

It seems they are looking at the issue, so I'll wait a bit. In the meantime, I'll try to downgrade lego.

[m1cr0man]

Oh of course - you could roll back lego too. Assuming you are using flakes:

• Add the nixpkgs repo at a revision before this PR (nixpkgs_old).
• Add an overlay setting lego to the old package

I'm on mobile but I'd otherwise type out an example overlay 😅

[rien]

Downgrade lego has resolved my issue.

[m1cr0man]

Great. I'll keep an eye out for the next lego update and might ask you to test it if you have the time 🙂

[rien]

I've already subbed on that issue, I'll keep an eye out as well.

[mweinelt]

It would probably be best to nudge the maintainer by offering to test changes he will propose.