tower: set up vaultwarden

4 files changed, 32 insertions, 25 deletions

diff --git a/hosts/tower/default.nix b/hosts/tower/default.nix
index 2fbfc6e..0cc56f5 100644
--- a/hosts/tower/default.nix
+++ b/hosts/tower/default.nix
@@ -48,7 +48,10 @@
     };
   };
 
-  environment.systemPackages = [ pkgs.git pkgs.helix ];
+  environment.systemPackages = [
+    pkgs.git
+    pkgs.helix
+  ];
 
   # This value determines the NixOS release from which the default
   # settings for stateful data, like file locations and database versions
diff --git a/hosts/tower/web/caddy.nix b/hosts/tower/web/caddy.nix
new file mode 100644
index 0000000..ee38db5
--- /dev/null
+++ b/hosts/tower/web/caddy.nix
@@ -0,0 +1,25 @@
+{ config, lib, ... }:
+let
+  cfg = config.services.caddy;
+in
+{
+  services.caddy = {
+    enable = true;
+    virtualHosts = {
+      "${config.services.vaultwarden.domain}" = {
+        listenAddresses = [ "100.64.0.6" ];
+        extraConfig = ''
+          auto_https off
+          tls {$CREDENTIALS_DIRECTORY}/sagittarius.cert {$CREDENTIALS_DIRECTORY}/sagittarius.key
+        '';
+      };
+    };
+  };
+
+  systemd.services.caddy = lib.mkIf cfg.enable {
+    serviceConfig.LoadCredential = [
+      "sagittarius.cert:/var/lib/secrets/certs/sagittarius.cert"
+      "sagittarius.key:/var/lib/secrets/certs/sagittarius.key"
+    ];
+  };
+}
diff --git a/hosts/tower/web/default.nix b/hosts/tower/web/default.nix
index 13ec615..b46bc80 100644
--- a/hosts/tower/web/default.nix
+++ b/hosts/tower/web/default.nix
@@ -5,6 +5,7 @@
     ./git.nix
     # ./static.nix
     # ./navidrome.nix
-    # ./vaultwarden.nix
+    ./vaultwarden.nix
+    ./caddy.nix
   ];
 }
diff --git a/hosts/tower/web/vaultwarden.nix b/hosts/tower/web/vaultwarden.nix
index 68bb1cd..adb9913 100644
--- a/hosts/tower/web/vaultwarden.nix
+++ b/hosts/tower/web/vaultwarden.nix
@@ -1,7 +1,5 @@
-{ config, ... }:
+{ ... }:
 let
-  cfg = config.services.vaultwarden.config;
-  # secrets = config.sops.secrets;
   domain = "vaultwarden.sorre.internal";
 in
 {
@@ -18,24 +16,4 @@ in
       ROCKET_LOG = "critical";
     };
   };
-
-  services.nginx.virtualHosts."vaultwarden" = {
-    serverName = domain;
-    # forceSSL = true;
-    listen = [
-      {
-        addr = "100.64.0.3";
-        port = 443;
-        # ssl = true;
-      }
-    ];
-
-    # sslCertificateKey = secrets."wg-ca-key".path;
-    # sslCertificate = secrets."wg-ca-crt".path;
-
-    locations."/" = {
-      proxyPass = "http://127.0.0.1:${toString cfg.ROCKET_PORT}";
-      recommendedProxySettings = true;
-    };
-  };
 }