diff options
| author | Isabella Bastaja <isabella@sorre.xyz> | 2026-05-30 21:24:56 +0200 |
|---|---|---|
| committer | Isabella Bastaja <isabella@sorre.xyz> | 2026-05-31 20:28:09 +0200 |
| commit | c629d5f5688fa58e9fd18b78f5d379863230c5b1 (patch) | |
| tree | e59cf5d1b4f94e839c6c9da93588491ddd2d2e7a /hosts | |
| parent | 644b4843185d7bca9e1ccd0db20b762b0116899b (diff) | |
set up PKI infra
Diffstat (limited to 'hosts')
| -rw-r--r-- | hosts/nyaan/network.nix | 5 | ||||
| -rw-r--r-- | hosts/sagittarius/sops.nix | 5 | ||||
| -rw-r--r-- | hosts/sagittarius/web/vaultwarden.nix | 12 |
3 files changed, 17 insertions, 5 deletions
diff --git a/hosts/nyaan/network.nix b/hosts/nyaan/network.nix index e855f6d..617b769 100644 --- a/hosts/nyaan/network.nix +++ b/hosts/nyaan/network.nix @@ -15,6 +15,10 @@ in }; }; + security.pki.certificateFiles = [ + ../../etc/certs/sagittarius.internal.crt + ]; + networking = { hostName = "nyaan"; useNetworkd = true; @@ -72,7 +76,6 @@ in "KopsiNet-5".pskRaw = "ext:kopsinet_psk"; "Pixel_3139" = { pskRaw = "ext:phone_hotspot_psk"; - hidden = true; }; "eduroam" = { authProtocols = [ "WPA-EAP" ]; diff --git a/hosts/sagittarius/sops.nix b/hosts/sagittarius/sops.nix index 7ba7536..2d08b24 100644 --- a/hosts/sagittarius/sops.nix +++ b/hosts/sagittarius/sops.nix @@ -18,6 +18,11 @@ owner = "nginx"; format = "binary"; }; + "wg-ca-key" = { + sopsFile = ../../secrets/ca/sagittarius.key; + owner = "nginx"; + format = "binary"; + }; }; }; } diff --git a/hosts/sagittarius/web/vaultwarden.nix b/hosts/sagittarius/web/vaultwarden.nix index d17e006..90e22f3 100644 --- a/hosts/sagittarius/web/vaultwarden.nix +++ b/hosts/sagittarius/web/vaultwarden.nix @@ -2,15 +2,15 @@ let hostname = config.networking.hostName; cfg = config.services.vaultwarden.config; + secrets = config.sops.secrets; in { services.vaultwarden = { enable = true; configureNginx = false; dbBackend = "sqlite"; - # domain = "${hostname}.internal"; + domain = "${hostname}.internal"; config = { - DOMAIN = "http://${hostname}.internal"; SIGNUPS_ALLOWED = true; ROCKET_ADDRESS = "127.0.0.1"; @@ -21,14 +21,18 @@ in services.nginx.virtualHosts."vaultwarden" = { serverName = "${hostname}.internal"; + forceSSL = true; listen = [ { addr = "[2301:db8:acad:a::1]"; # TODO: extract from topology instead of hardcoding - port = 80; - ssl = false; + port = 443; + ssl = true; } ]; + sslCertificateKey = secrets."wg-ca-key".path; + sslCertificate = ../../../etc/certs/sagittarius.internal.crt; + locations."/" = { proxyPass = "http://127.0.0.1:${toString cfg.ROCKET_PORT}"; recommendedProxySettings = true; |