@@ -163,9 +163,8 @@ let
163163 [ "--dns" data.dnsProvider ]
164164 ++ optionals (!data.dnsPropagationCheck) [ "--dns.disable-cp" ]
165165 ++ optionals (data.dnsResolver != null) [ "--dns.resolvers" data.dnsResolver ]
166− ) else (
167− [ "--http" "--http.webroot" data.webroot ]
168− );
166+ ) else if data.listenHTTP != null then [ "--http" "--http.port" data.listenHTTP ]
167+ else [ "--http" "--http.webroot" data.webroot ];
169168
170169 commonOpts = [
171170 "--accept-tos" # Checking the option is covered by the assertions
@@ -321,6 +320,8 @@ let
321320 }
322321 fi
323322 '');
323+ } // optionalAttrs (data.listenHTTP != null && toInt (elemAt (splitString ":" data.listenHTTP) 1) < 1024) {
324+ AmbientCapabilities = "CAP_NET_BIND_SERVICE";
324325 };
325326
326327 # Working directory will be /tmp
@@ -454,6 +455,17 @@ let
454455 '';
455456 };
456457
458+ listenHTTP = mkOption {
459+ type = types.nullOr types.str;
460+ default = null;
461+ example = ":1360";
462+ description = ''
463+ Interface and port to listen on to solve HTTP challenges
464+ in the form [INTERFACE]:PORT.
465+ If you use a port other than 80, you must proxy port 80 to this port.
466+ '';
467+ };
468+
457469 server = mkOption {
458470 type = types.nullOr types.str;
459471 default = null;
@@ -783,6 +795,28 @@ in {
783795 `security.acme.certs.${cert}.webroot` are mutually exclusive.
784796 '';
785797 }
798+ {
799+ assertion = data.webroot == null || data.listenHTTP == null;
800+ message = ''
801+ Options `security.acme.certs.${cert}.webroot` and
802+ `security.acme.certs.${cert}.listenHTTP` are mutually exclusive.
803+ '';
804+ }
805+ {
806+ assertion = data.listenHTTP == null || data.dnsProvider == null;
807+ message = ''
808+ Options `security.acme.certs.${cert}.listenHTTP` and
809+ `security.acme.certs.${cert}.dnsProvider` are mutually exclusive.
810+ '';
811+ }
812+ {
813+ assertion = data.dnsProvider != null || data.webroot != null || data.listenHTTP != null;
814+ message = ''
815+ One of `security.acme.certs.${cert}.dnsProvider`,
816+ `security.acme.certs.${cert}.webroot`, or
817+ `security.acme.certs.${cert}.listenHTTP` must be provided.
818+ '';
819+ }
786820 ]) cfg.certs));
787821
788822 users.users.acme = {