From ed09d028bb1d11de022ec9a330a3b5f37ab2c75d Mon Sep 17 00:00:00 2001
From: Isabella Bastaja <isabella@sorre.xyz>
Date: Thu, 20 Aug 2026 22:53:40 +0200
Subject: tower: set up vaultwarden

---
 hosts/tower/web/caddy.nix | 25 +++++++++++++++++++++++++
 1 file changed, 25 insertions(+)
 create mode 100644 hosts/tower/web/caddy.nix

(limited to 'hosts/tower/web/caddy.nix')

diff --git a/hosts/tower/web/caddy.nix b/hosts/tower/web/caddy.nix
new file mode 100644
index 0000000..ee38db5
--- /dev/null
+++ b/hosts/tower/web/caddy.nix
@@ -0,0 +1,25 @@
+{ config, lib, ... }:
+let
+  cfg = config.services.caddy;
+in
+{
+  services.caddy = {
+    enable = true;
+    virtualHosts = {
+      "${config.services.vaultwarden.domain}" = {
+        listenAddresses = [ "100.64.0.6" ];
+        extraConfig = ''
+          auto_https off
+          tls {$CREDENTIALS_DIRECTORY}/sagittarius.cert {$CREDENTIALS_DIRECTORY}/sagittarius.key
+        '';
+      };
+    };
+  };
+
+  systemd.services.caddy = lib.mkIf cfg.enable {
+    serviceConfig.LoadCredential = [
+      "sagittarius.cert:/var/lib/secrets/certs/sagittarius.cert"
+      "sagittarius.key:/var/lib/secrets/certs/sagittarius.key"
+    ];
+  };
+}
-- 
cgit v1.3.1