diff options
| author | Isabella Bastaja <isabella@sorre.xyz> | 2026-05-30 21:24:56 +0200 |
|---|---|---|
| committer | Isabella Bastaja <isabella@sorre.xyz> | 2026-05-31 20:28:09 +0200 |
| commit | c629d5f5688fa58e9fd18b78f5d379863230c5b1 (patch) | |
| tree | e59cf5d1b4f94e839c6c9da93588491ddd2d2e7a /hosts/sagittarius/web | |
| parent | 644b4843185d7bca9e1ccd0db20b762b0116899b (diff) | |
set up PKI infra
Diffstat (limited to 'hosts/sagittarius/web')
| -rw-r--r-- | hosts/sagittarius/web/vaultwarden.nix | 12 |
1 files changed, 8 insertions, 4 deletions
diff --git a/hosts/sagittarius/web/vaultwarden.nix b/hosts/sagittarius/web/vaultwarden.nix index d17e006..90e22f3 100644 --- a/hosts/sagittarius/web/vaultwarden.nix +++ b/hosts/sagittarius/web/vaultwarden.nix @@ -2,15 +2,15 @@ let hostname = config.networking.hostName; cfg = config.services.vaultwarden.config; + secrets = config.sops.secrets; in { services.vaultwarden = { enable = true; configureNginx = false; dbBackend = "sqlite"; - # domain = "${hostname}.internal"; + domain = "${hostname}.internal"; config = { - DOMAIN = "http://${hostname}.internal"; SIGNUPS_ALLOWED = true; ROCKET_ADDRESS = "127.0.0.1"; @@ -21,14 +21,18 @@ in services.nginx.virtualHosts."vaultwarden" = { serverName = "${hostname}.internal"; + forceSSL = true; listen = [ { addr = "[2301:db8:acad:a::1]"; # TODO: extract from topology instead of hardcoding - port = 80; - ssl = false; + port = 443; + ssl = true; } ]; + sslCertificateKey = secrets."wg-ca-key".path; + sslCertificate = ../../../etc/certs/sagittarius.internal.crt; + locations."/" = { proxyPass = "http://127.0.0.1:${toString cfg.ROCKET_PORT}"; recommendedProxySettings = true; |