2 files changed, 41 insertions, 32 deletions

diff --git a/hosts/tower/web/caddy.nix b/hosts/tower/web/caddy.nix
index f375d3b..5979806 100644
--- a/hosts/tower/web/caddy.nix
+++ b/hosts/tower/web/caddy.nix
@@ -22,6 +22,10 @@ let
     socket = config.services.phpfpm.pools.kanboard.socket;
     package = config.services.kanboard.package;
   };
+  cgitInternal = {
+    domain = config.services.cgit.internal.nginx.virtualHost;
+    port = 1923;
+  };
   blog.port = 7291;
 
   tls-config = "tls {$CREDENTIALS_DIRECTORY}/sorre.internal.crt {$CREDENTIALS_DIRECTORY}/sorre.internal.key";
@@ -85,6 +89,18 @@ in
           }
         '';
       };
+
+      "${cgitInternal.domain}" = {
+        listenAddresses = [ wg-ip ];
+        extraConfig = ''
+          ${tls-config}
+
+          reverse_proxy :${toString cgitInternal.port} {
+            header_up True-Client-IP {remote_host}
+            header_up X-Real-IP {remote_host}
+          }
+        '';
+      };
     };
   };
 
diff --git a/hosts/tower/web/git.nix b/hosts/tower/web/git.nix
index e46eb90..fd913aa 100644
--- a/hosts/tower/web/git.nix
+++ b/hosts/tower/web/git.nix
@@ -1,7 +1,6 @@
-{ pkgs, config, ... }:
+{ pkgs, ... }:
 let
-  # secrets = config.sops.secrets;
-  # domainInternal = "git.sorre.internal";
+  domainInternal = "git.sorre.internal";
   domainPublic = "git.sorre.xyz";
 
   commonSettings = {
@@ -9,41 +8,35 @@ let
   };
 in
 {
+  # cgit-public is proxied via enode
   networking.firewall.allowedTCPPorts = [ 8721 ];
+
   services.nginx = {
     enable = true;
-    # virtualHosts."${domainInternal}" = {
-    #   forceSSL = true;
-    #   # sslCertificateKey = secrets."wg-ca-key".path;
-    #   # sslCertificate = secrets."wg-ca-crt".path;
-    #   listen = [
-    #     {
-    #       addr = "100.64.0.3";
-    #       port = 443;
-    #       # ssl = true;
-    #     }
-    #   ];
-    # };
+    virtualHosts."${domainInternal}".listen = [
+      {
+        addr = "127.0.0.1";
+        port = 1923;
+      }
+    ];
 
-    virtualHosts."${domainPublic}" = {
-      listen = [
-        {
-          addr = "100.64.0.6";
-          port = 8721;
-        }
-      ];
-    };
+    virtualHosts."${domainPublic}".listen = [
+      {
+        addr = "100.64.0.6";
+        port = 8721;
+      }
+    ];
   };
 
-  # services.cgit.internal = {
-  #   enable = true;
-  #   user = "cgit-internal";
-  #   group = "cgit";
-  #   nginx.virtualHost = domainInternal;
-  #   gitHttpBackend.checkExportOkFiles = false;
-  #   scanPath = "/var/lib/git/repos/isabella";
-  #   settings = commonSettings;
-  # };
+  services.cgit.internal = {
+    enable = true;
+    user = "cgit-internal";
+    group = "cgit";
+    nginx.virtualHost = domainInternal;
+    gitHttpBackend.checkExportOkFiles = false;
+    scanPath = "/var/lib/git/repos/isabella";
+    settings = commonSettings;
+  };
 
   services.cgit.public = {
     enable = true;