vidhar: selfsigned tls cert

1 files changed, 11 insertions, 0 deletions

diff --git a/hosts/vidhar/default.nix b/hosts/vidhar/default.nix
index 0cb11ec8..16405a26 100644
--- a/hosts/vidhar/default.nix
+++ b/hosts/vidhar/default.nix
@@ -123,6 +123,10 @@
       };
       virtualHosts = {
         ${config.services.grafana.domain} = {
+          addSSL = true;
+          forceSSL = true;
+          sslCertificate = ./selfsigned.crt;
+          sslCertificateKey = config.sops.secrets."selfsigned.key".path;
           locations."/" = {
             proxyPass = "http://grafana/";
             proxyWebsockets = true;
@@ -149,6 +153,13 @@
       sopsFile = ./grafana-secret-key;
       owner = "grafana";
     };
+    sops.secrets."selfsigned.key" = {
+      format = "binary";
+      sopsFile = ./selfsigned.key;
+      group = "ssl";
+      mode = "0440";
+    };
+    users.groups.ssl.members = ["nginx"];
 
     services.loki = {
       enable = true;