From c629d5f5688fa58e9fd18b78f5d379863230c5b1 Mon Sep 17 00:00:00 2001
From: Isabella Bastaja <isabella@sorre.xyz>
Date: Sat, 30 May 2026 21:24:56 +0200
Subject: set up PKI infra

---
 hosts/nyaan/network.nix               |  5 ++++-
 hosts/sagittarius/sops.nix            |  5 +++++
 hosts/sagittarius/web/vaultwarden.nix | 12 ++++++++----
 3 files changed, 17 insertions(+), 5 deletions(-)

(limited to 'hosts')

diff --git a/hosts/nyaan/network.nix b/hosts/nyaan/network.nix
index e855f6d..617b769 100644
--- a/hosts/nyaan/network.nix
+++ b/hosts/nyaan/network.nix
@@ -15,6 +15,10 @@ in
     };
   };
 
+  security.pki.certificateFiles = [
+    ../../etc/certs/sagittarius.internal.crt
+  ];
+
   networking = {
     hostName = "nyaan";
     useNetworkd = true;
@@ -72,7 +76,6 @@ in
         "KopsiNet-5".pskRaw = "ext:kopsinet_psk";
         "Pixel_3139" = {
           pskRaw = "ext:phone_hotspot_psk";
-          hidden = true;
         };
         "eduroam" = {
           authProtocols = [ "WPA-EAP" ];
diff --git a/hosts/sagittarius/sops.nix b/hosts/sagittarius/sops.nix
index 7ba7536..2d08b24 100644
--- a/hosts/sagittarius/sops.nix
+++ b/hosts/sagittarius/sops.nix
@@ -18,6 +18,11 @@
         owner = "nginx";
         format = "binary";
       };
+      "wg-ca-key" = {
+        sopsFile = ../../secrets/ca/sagittarius.key;
+        owner = "nginx";
+        format = "binary";
+      };
     };
   };
 }
diff --git a/hosts/sagittarius/web/vaultwarden.nix b/hosts/sagittarius/web/vaultwarden.nix
index d17e006..90e22f3 100644
--- a/hosts/sagittarius/web/vaultwarden.nix
+++ b/hosts/sagittarius/web/vaultwarden.nix
@@ -2,15 +2,15 @@
 let
   hostname = config.networking.hostName;
   cfg = config.services.vaultwarden.config;
+  secrets = config.sops.secrets;
 in
 {
   services.vaultwarden = {
     enable = true;
     configureNginx = false;
     dbBackend = "sqlite";
-    # domain = "${hostname}.internal";
+    domain = "${hostname}.internal";
     config = {
-      DOMAIN = "http://${hostname}.internal";
       SIGNUPS_ALLOWED = true;
 
       ROCKET_ADDRESS = "127.0.0.1";
@@ -21,14 +21,18 @@ in
 
   services.nginx.virtualHosts."vaultwarden" = {
     serverName = "${hostname}.internal";
+    forceSSL = true;
     listen = [
       {
         addr = "[2301:db8:acad:a::1]"; # TODO: extract from topology instead of hardcoding
-        port = 80;
-        ssl = false;
+        port = 443;
+        ssl = true;
       }
     ];
 
+    sslCertificateKey = secrets."wg-ca-key".path;
+    sslCertificate = ../../../etc/certs/sagittarius.internal.crt;
+
     locations."/" = {
       proxyPass = "http://127.0.0.1:${toString cfg.ROCKET_PORT}";
       recommendedProxySettings = true;
-- 
cgit v1.3.1