From 629281ae1d10d3ceacd3f380f233c6adba3d062b Mon Sep 17 00:00:00 2001
From: Isabella Bastaja <isabella@sorre.xyz>
Date: Tue, 27 Oct 2026 02:52:12 +0100
Subject: enode: set up mTLS access to vaultwarden

---
 hosts/enode/caddy.nix | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

(limited to 'hosts/enode/caddy.nix')

diff --git a/hosts/enode/caddy.nix b/hosts/enode/caddy.nix
index afb3b69..6a0cbdd 100644
--- a/hosts/enode/caddy.nix
+++ b/hosts/enode/caddy.nix
@@ -40,6 +40,21 @@ in
           header_up X-Real-IP {remote_host}
         }
       '';
+      "vaultwarden.sorre.xyz".extraConfig = ''
+        tls {
+          client_auth {
+            mode require_and_verify
+            trust_pool file {
+              pem_file ${../../etc/certs/rootCA.crt}
+            }
+          }
+        }
+
+        reverse_proxy https://vaultwarden.sorre.internal:443 {
+          header_up True-Client-IP {remote_host}
+          header_up X-Real-IP {remote_host}
+        }
+      '';
     }
     // simpleProxyVirtualHosts;
   };
-- 
cgit v1.3.1