From c629d5f5688fa58e9fd18b78f5d379863230c5b1 Mon Sep 17 00:00:00 2001
From: Isabella Bastaja <isabella@sorre.xyz>
Date: Sat, 30 May 2026 21:24:56 +0200
Subject: set up PKI infra

---
 hosts/sagittarius/web/vaultwarden.nix | 12 ++++++++----
 1 file changed, 8 insertions(+), 4 deletions(-)

(limited to 'hosts/sagittarius/web')

diff --git a/hosts/sagittarius/web/vaultwarden.nix b/hosts/sagittarius/web/vaultwarden.nix
index d17e006..90e22f3 100644
--- a/hosts/sagittarius/web/vaultwarden.nix
+++ b/hosts/sagittarius/web/vaultwarden.nix
@@ -2,15 +2,15 @@
 let
   hostname = config.networking.hostName;
   cfg = config.services.vaultwarden.config;
+  secrets = config.sops.secrets;
 in
 {
   services.vaultwarden = {
     enable = true;
     configureNginx = false;
     dbBackend = "sqlite";
-    # domain = "${hostname}.internal";
+    domain = "${hostname}.internal";
     config = {
-      DOMAIN = "http://${hostname}.internal";
       SIGNUPS_ALLOWED = true;
 
       ROCKET_ADDRESS = "127.0.0.1";
@@ -21,14 +21,18 @@ in
 
   services.nginx.virtualHosts."vaultwarden" = {
     serverName = "${hostname}.internal";
+    forceSSL = true;
     listen = [
       {
         addr = "[2301:db8:acad:a::1]"; # TODO: extract from topology instead of hardcoding
-        port = 80;
-        ssl = false;
+        port = 443;
+        ssl = true;
       }
     ];
 
+    sslCertificateKey = secrets."wg-ca-key".path;
+    sslCertificate = ../../../etc/certs/sagittarius.internal.crt;
+
     locations."/" = {
       proxyPass = "http://127.0.0.1:${toString cfg.ROCKET_PORT}";
       recommendedProxySettings = true;
-- 
cgit v1.3.1