nixos/acme: add profile option (#467908)

nixos/modules/security/acme/default.nix

@@ -211,7 +211,8 @@ let
           ${toString acmeServer} ${toString data.dnsProvider}
           ${toString data.ocspMustStaple} ${data.keyType}
         ''
-        + (lib.optionalString (data.csr != null) (" - " + data.csr));
+        + lib.optionalString (data.csr != null) " - ${data.csr}"
+        + lib.optionalString (data.profile != null) " - ${data.profile}";
       certDir = mkHash hashData;
       # TODO remove domainHash usage entirely. Waiting on go-acme/lego#1532
       domainHash = mkHash "${lib.concatStringsSep " " extraDomains} ${data.domain}";
@@ -284,6 +285,7 @@ let
         commonOpts
         ++ [ "run" ]
         ++ lib.optionals data.ocspMustStaple [ "--must-staple" ]
+        ++ lib.optionals (data.profile != null) [ "--profile=${data.profile}" ]
         ++ data.extraLegoRunFlags
       );
       renewOpts = lib.escapeShellArgs (
@@ -293,6 +295,7 @@ let
           "--no-random-sleep"
         ]
         ++ lib.optionals data.ocspMustStaple [ "--must-staple" ]
+        ++ lib.optionals (data.profile != null) [ "--profile=${data.profile}" ]
         ++ data.extraLegoRenewFlags
       );
 
@@ -799,6 +802,14 @@ let
           '';
         };
 
+        profile = lib.mkOption {
+          type = lib.types.nullOr lib.types.str;
+          inherit (defaultAndText "profile" null) default defaultText;
+          description = ''
+            The certificate profile to choose if the CA offers multiple profiles.
+          '';
+        };
+
         extraLegoFlags = lib.mkOption {
           type = lib.types.listOf lib.types.str;
           inherit (defaultAndText "extraLegoFlags" [ ]) default defaultText;