From 337b90ced374c9777a7687337aae114b3c15c6d3 Mon Sep 17 00:00:00 2001
From: ediblerope <fredrik@nordhammer.it>
Date: Tue, 14 Apr 2026 22:41:55 +0100
Subject: [PATCH] Fix ACME DNS resolver flag placement (global, not subcommand)

--dns.resolvers is a global lego flag, not a run/renew subcommand
flag. Use extraLegoFlags instead of extraLegoRunFlags.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---
 services/nginx.nix | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/services/nginx.nix b/services/nginx.nix
index b26dfea..4a4bcfe 100644
--- a/services/nginx.nix
+++ b/services/nginx.nix
@@ -62,8 +62,7 @@ in
         domain = "*.nordhammer.it";
         extraDomainNames = [ "nordhammer.it" ];
         dnsProvider = "cloudflare";
-        extraLegoRunFlags = [ "--dns.resolvers" "1.1.1.1:53" ];
-        extraLegoRenewFlags = [ "--dns.resolvers" "1.1.1.1:53" ];
+        extraLegoFlags = [ "--dns.resolvers" "1.1.1.1:53" ];
         credentialFiles = {
           "CF_DNS_API_TOKEN_FILE" = "/var/secrets/cloudflare-token";
         };