From ed09d028bb1d11de022ec9a330a3b5f37ab2c75d Mon Sep 17 00:00:00 2001
From: Isabella Bastaja <isabella@sorre.xyz>
Date: Thu, 20 Aug 2026 22:53:40 +0200
Subject: tower: set up vaultwarden

---
 hosts/tower/web/caddy.nix       | 25 +++++++++++++++++++++++++
 hosts/tower/web/default.nix     |  3 ++-
 hosts/tower/web/vaultwarden.nix | 24 +-----------------------
 3 files changed, 28 insertions(+), 24 deletions(-)
 create mode 100644 hosts/tower/web/caddy.nix

(limited to 'hosts/tower/web')

diff --git a/hosts/tower/web/caddy.nix b/hosts/tower/web/caddy.nix
new file mode 100644
index 0000000..ee38db5
--- /dev/null
+++ b/hosts/tower/web/caddy.nix
@@ -0,0 +1,25 @@
+{ config, lib, ... }:
+let
+  cfg = config.services.caddy;
+in
+{
+  services.caddy = {
+    enable = true;
+    virtualHosts = {
+      "${config.services.vaultwarden.domain}" = {
+        listenAddresses = [ "100.64.0.6" ];
+        extraConfig = ''
+          auto_https off
+          tls {$CREDENTIALS_DIRECTORY}/sagittarius.cert {$CREDENTIALS_DIRECTORY}/sagittarius.key
+        '';
+      };
+    };
+  };
+
+  systemd.services.caddy = lib.mkIf cfg.enable {
+    serviceConfig.LoadCredential = [
+      "sagittarius.cert:/var/lib/secrets/certs/sagittarius.cert"
+      "sagittarius.key:/var/lib/secrets/certs/sagittarius.key"
+    ];
+  };
+}
diff --git a/hosts/tower/web/default.nix b/hosts/tower/web/default.nix
index 13ec615..b46bc80 100644
--- a/hosts/tower/web/default.nix
+++ b/hosts/tower/web/default.nix
@@ -5,6 +5,7 @@
     ./git.nix
     # ./static.nix
     # ./navidrome.nix
-    # ./vaultwarden.nix
+    ./vaultwarden.nix
+    ./caddy.nix
   ];
 }
diff --git a/hosts/tower/web/vaultwarden.nix b/hosts/tower/web/vaultwarden.nix
index 68bb1cd..adb9913 100644
--- a/hosts/tower/web/vaultwarden.nix
+++ b/hosts/tower/web/vaultwarden.nix
@@ -1,7 +1,5 @@
-{ config, ... }:
+{ ... }:
 let
-  cfg = config.services.vaultwarden.config;
-  # secrets = config.sops.secrets;
   domain = "vaultwarden.sorre.internal";
 in
 {
@@ -18,24 +16,4 @@ in
       ROCKET_LOG = "critical";
     };
   };
-
-  services.nginx.virtualHosts."vaultwarden" = {
-    serverName = domain;
-    # forceSSL = true;
-    listen = [
-      {
-        addr = "100.64.0.3";
-        port = 443;
-        # ssl = true;
-      }
-    ];
-
-    # sslCertificateKey = secrets."wg-ca-key".path;
-    # sslCertificate = secrets."wg-ca-crt".path;
-
-    locations."/" = {
-      proxyPass = "http://127.0.0.1:${toString cfg.ROCKET_PORT}";
-      recommendedProxySettings = true;
-    };
-  };
 }
-- 
cgit v1.3.1