matrix-synapse: utilisation du certificat ACME

services/haproxy-acme.nix

@@ -133,8 +133,8 @@ in
         ) cfg.services;
         webroot = "/var/www/challenges";
         email = "paul@nyanlout.re";
-        user = "haproxy";
-        group = "haproxy";
+        allowKeysForGroup = true;
+        group = "acme";
         postRun = ''
           systemctl reload haproxy.service
         '';
@@ -142,6 +142,8 @@ in
     };
     security.acme.directory = "/var/lib/acme";
 
+    users.groups.acme.members = [ "haproxy" ];
+
     networking.firewall.allowedTCPPorts = [
       80 443
     ];