From eed8d048d344e36517836f37dd3c450bf349caeb Mon Sep 17 00:00:00 2001
From: Isabella Bastaja <isabella@sorre.xyz>
Date: Thu, 4 Jun 2026 21:28:39 +0200
Subject: sagittarius: move navidrome to be wg-only

---
 hosts/sagittarius/web/navidrome.nix | 19 ++++++++++++++++---
 1 file changed, 16 insertions(+), 3 deletions(-)

(limited to 'hosts/sagittarius/web/navidrome.nix')

diff --git a/hosts/sagittarius/web/navidrome.nix b/hosts/sagittarius/web/navidrome.nix
index e65b9dc..f1c4cb6 100644
--- a/hosts/sagittarius/web/navidrome.nix
+++ b/hosts/sagittarius/web/navidrome.nix
@@ -1,6 +1,8 @@
 { config, ... }:
 let
   cfg = config.services.navidrome;
+  secrets = config.sops.secrets;
+  domain = "music.sorre.internal";
 in
 {
   services.navidrome = {
@@ -8,7 +10,7 @@ in
     settings = {
       MusicFolder = "/var/navidrome/music";
       DataFolder = "/var/navidrome/data";
-      BaseUrl = "https://sorre.xyz/navidrome";
+      BaseUrl = "https://${domain}";
       Port = 4533;
       Address = "127.0.0.1";
       openFirewall = false;
@@ -18,9 +20,20 @@ in
   services.nginx = {
     enable = true;
 
-    virtualHosts."music.sorre.xyz" = {
-      enableACME = true;
+    virtualHosts."navidrome" = {
+      serverName = domain;
       forceSSL = true;
+      listen = [
+        {
+          addr = "[2301:db8:acad:a::1]";
+          port = 443;
+          ssl = true;
+        }
+      ];
+
+      sslCertificateKey = secrets."wg-ca-key".path;
+      sslCertificate = secrets."wg-ca-crt".path;
+
       locations."/" = {
         proxyPass = "http://127.0.0.1:${toString cfg.settings.Port}";
         recommendedProxySettings = true;
-- 
cgit v1.3.1