diff options
Diffstat (limited to 'hosts')
| -rw-r--r-- | hosts/enode/caddy.nix | 15 | ||||
| -rw-r--r-- | hosts/enode/default.nix | 5 |
2 files changed, 20 insertions, 0 deletions
diff --git a/hosts/enode/caddy.nix b/hosts/enode/caddy.nix index afb3b69..6a0cbdd 100644 --- a/hosts/enode/caddy.nix +++ b/hosts/enode/caddy.nix @@ -40,6 +40,21 @@ in header_up X-Real-IP {remote_host} } ''; + "vaultwarden.sorre.xyz".extraConfig = '' + tls { + client_auth { + mode require_and_verify + trust_pool file { + pem_file ${../../etc/certs/rootCA.crt} + } + } + } + + reverse_proxy https://vaultwarden.sorre.internal:443 { + header_up True-Client-IP {remote_host} + header_up X-Real-IP {remote_host} + } + ''; } // simpleProxyVirtualHosts; }; diff --git a/hosts/enode/default.nix b/hosts/enode/default.nix index 0461bf7..ed9ce34 100644 --- a/hosts/enode/default.nix +++ b/hosts/enode/default.nix @@ -123,6 +123,11 @@ in ]; }; + # so caddy trusts our .internal certs + security.pki.certificateFiles = [ + ../../etc/certs/rootCA.crt + ]; + # This value determines the NixOS release from which the default # settings for stateful data, like file locations and database versions # on your system were taken. It‘s perfectly fine and recommended to leave |