From d57e9c1cfab219d43f1616a78503337cd9dde664 Mon Sep 17 00:00:00 2001
From: Defelo <mail@defelo.de>
Date: Thu, 4 Dec 2025 19:42:39 +0100
Subject: [PATCH] nixos/acme: add profile option

---
 nixos/modules/security/acme/default.nix | 13 ++++++++++++-
 1 file changed, 12 insertions(+), 1 deletion(-)

diff --git a/nixos/modules/security/acme/default.nix b/nixos/modules/security/acme/default.nix
index 952637d471c3..c03dd38ce472 100644
--- a/nixos/modules/security/acme/default.nix
+++ b/nixos/modules/security/acme/default.nix
@@ -211,7 +211,8 @@ let
           ${toString acmeServer} ${toString data.dnsProvider}
           ${toString data.ocspMustStaple} ${data.keyType}
         ''
-        + (lib.optionalString (data.csr != null) (" - " + data.csr));
+        + lib.optionalString (data.csr != null) " - ${data.csr}"
+        + lib.optionalString (data.profile != null) " - ${data.profile}";
       certDir = mkHash hashData;
       # TODO remove domainHash usage entirely. Waiting on go-acme/lego#1532
       domainHash = mkHash "${lib.concatStringsSep " " extraDomains} ${data.domain}";
@@ -284,6 +285,7 @@ let
         commonOpts
         ++ [ "run" ]
         ++ lib.optionals data.ocspMustStaple [ "--must-staple" ]
+        ++ lib.optionals (data.profile != null) [ "--profile=${data.profile}" ]
         ++ data.extraLegoRunFlags
       );
       renewOpts = lib.escapeShellArgs (
@@ -293,6 +295,7 @@ let
           "--no-random-sleep"
         ]
         ++ lib.optionals data.ocspMustStaple [ "--must-staple" ]
+        ++ lib.optionals (data.profile != null) [ "--profile=${data.profile}" ]
         ++ data.extraLegoRenewFlags
       );
 
@@ -799,6 +802,14 @@ let
           '';
         };
 
+        profile = lib.mkOption {
+          type = lib.types.nullOr lib.types.str;
+          inherit (defaultAndText "profile" null) default defaultText;
+          description = ''
+            The certificate profile to choose if the CA offers multiple profiles.
+          '';
+        };
+
         extraLegoFlags = lib.mkOption {
           type = lib.types.listOf lib.types.str;
           inherit (defaultAndText "extraLegoFlags" [ ]) default defaultText;