enode: set up mTLS access to vaultwarden

2 files changed, 20 insertions, 0 deletions

diff --git a/hosts/enode/caddy.nix b/hosts/enode/caddy.nix
index afb3b69..6a0cbdd 100644
--- a/hosts/enode/caddy.nix
+++ b/hosts/enode/caddy.nix
@@ -40,6 +40,21 @@ in
           header_up X-Real-IP {remote_host}
         }
       '';
+      "vaultwarden.sorre.xyz".extraConfig = ''
+        tls {
+          client_auth {
+            mode require_and_verify
+            trust_pool file {
+              pem_file ${../../etc/certs/rootCA.crt}
+            }
+          }
+        }
+
+        reverse_proxy https://vaultwarden.sorre.internal:443 {
+          header_up True-Client-IP {remote_host}
+          header_up X-Real-IP {remote_host}
+        }
+      '';
     }
     // simpleProxyVirtualHosts;
   };
diff --git a/hosts/enode/default.nix b/hosts/enode/default.nix
index 0461bf7..ed9ce34 100644
--- a/hosts/enode/default.nix
+++ b/hosts/enode/default.nix
@@ -123,6 +123,11 @@ in
     ];
   };
 
+  # so caddy trusts our .internal certs
+  security.pki.certificateFiles = [
+    ../../etc/certs/rootCA.crt
+  ];
+
   # This value determines the NixOS release from which the default
   # settings for stateful data, like file locations and database versions
   # on your system were taken. It‘s perfectly fine and recommended to leave