changes

hosts/web-arm/modules/web/typo3.nix

@@ -50,6 +50,14 @@ let
             Authorized keys for the typo3 instance ssh user.
           '';
         };
+
+        acmeRoot = mkOption {
+          type = types.nullOr types.str;
+          default = null;
+          description = lib.mdDoc ''
+            Directory for the ACME challenge, which is public. Don’t put certs or keys in here. Set to null to inherit from config.security.acme.
+          '';
+        };
       };
     };
 in
@@ -183,7 +191,7 @@ in
     nameValuePair domain {
       forceSSL = true;
       enableACME = true;
-      acmeRoot = null;
+      acmeRoot = instanceOpts.acmeRoot;
       root = cfg.dataDir + "/" + domain + "/current/public";
       serverAliases = instanceOpts.domainAliases;
 
@@ -337,13 +345,6 @@ in
         # access_log logs/static.log; # I don't usually include a static log
       '';
 
-      # Cache Media: images, icons, video, audio, HTC
-      locations."~* \\.(?:jpg|jpeg|gif|png|ico|cur|gz|svg|svgz|mp4|ogg|ogv|webm|htc|woff2)$".extraConfig = ''
-        expires 1y;
-        access_log off;
-        add_header Cache-Control "public";
-      '';
-
       # Feed
       locations."~* \\.(?:rss|atom)$".extraConfig = ''
         expires 1h;
@@ -351,7 +352,7 @@ in
       '';
 
       # Cache CSS, Javascript, Images, Icons, Video, Audio, HTC, Fonts
-      locations."~* \\.(?:css|js|jpg|jpeg|gif|png|ico|cur|gz|svg|svgz|mp4|ogg|ogv|webm|htc|woff2)$".extraConfig = ''
+      locations."~* \\.(?:css|js|jpg|jpeg|gif|png|ico|cur|gz|svg|svgz|mp4|ogg|ogv|webm|webp|htc|woff2)$".extraConfig = ''
         expires 1y;
         access_log off;
         add_header Cache-Control "public";