diff options
| author | Isabella Bastaja <isabella@sorre.xyz> | 2026-06-04 21:28:39 +0200 |
|---|---|---|
| committer | Isabella Bastaja <isabella@sorre.xyz> | 2026-06-04 21:28:55 +0200 |
| commit | eed8d048d344e36517836f37dd3c450bf349caeb (patch) | |
| tree | ce7e7e5a190bda9167635cb1de2dc51151b34eb7 | |
| parent | 738ff06025b7da9e3d3c30a9cce5c342c5f70c61 (diff) | |
sagittarius: move navidrome to be wg-only
| -rw-r--r-- | hosts/sagittarius/web/navidrome.nix | 19 | ||||
| -rw-r--r-- | hosts/sagittarius/web/vaultwarden.nix | 2 |
2 files changed, 17 insertions, 4 deletions
diff --git a/hosts/sagittarius/web/navidrome.nix b/hosts/sagittarius/web/navidrome.nix index e65b9dc..f1c4cb6 100644 --- a/hosts/sagittarius/web/navidrome.nix +++ b/hosts/sagittarius/web/navidrome.nix @@ -1,6 +1,8 @@ { config, ... }: let cfg = config.services.navidrome; + secrets = config.sops.secrets; + domain = "music.sorre.internal"; in { services.navidrome = { @@ -8,7 +10,7 @@ in settings = { MusicFolder = "/var/navidrome/music"; DataFolder = "/var/navidrome/data"; - BaseUrl = "https://sorre.xyz/navidrome"; + BaseUrl = "https://${domain}"; Port = 4533; Address = "127.0.0.1"; openFirewall = false; @@ -18,9 +20,20 @@ in services.nginx = { enable = true; - virtualHosts."music.sorre.xyz" = { - enableACME = true; + virtualHosts."navidrome" = { + serverName = domain; forceSSL = true; + listen = [ + { + addr = "[2301:db8:acad:a::1]"; + port = 443; + ssl = true; + } + ]; + + sslCertificateKey = secrets."wg-ca-key".path; + sslCertificate = secrets."wg-ca-crt".path; + locations."/" = { proxyPass = "http://127.0.0.1:${toString cfg.settings.Port}"; recommendedProxySettings = true; diff --git a/hosts/sagittarius/web/vaultwarden.nix b/hosts/sagittarius/web/vaultwarden.nix index acff87f..fc4debe 100644 --- a/hosts/sagittarius/web/vaultwarden.nix +++ b/hosts/sagittarius/web/vaultwarden.nix @@ -24,7 +24,7 @@ in forceSSL = true; listen = [ { - addr = "[2301:db8:acad:a::1]"; # TODO: extract from topology instead of hardcoding + addr = "[2301:db8:acad:a::1]"; port = 443; ssl = true; } |