From 0f39cfdf3273f10b897fb3ac0448a0e224e10ea1 Mon Sep 17 00:00:00 2001
From: Leonhard Kost <leonhard.kost@gmail.com>
Date: Tue, 2 Jun 2026 12:54:17 +0200
Subject: [PATCH] feat: use one acme host for the whole domain

---
 nixos/server/default.nix     | 19 +++++++++++++++++++
 nixos/server/vaultwarden.nix |  9 ++++-----
 2 files changed, 23 insertions(+), 5 deletions(-)

diff --git a/nixos/server/default.nix b/nixos/server/default.nix
index 578d546..de5f3e1 100644
--- a/nixos/server/default.nix
+++ b/nixos/server/default.nix
@@ -50,4 +50,23 @@
       AllowUsers = [ "leonhard" ];
     };
   };
+
+  security.acme = {
+    acceptTerms = true;
+    defaults.email = "admin@${config.kekleo.domain}";
+    defaults.webroot = "/var/lib/acme/acme-challenge/";
+    certs.${config.kekleo.domain} = {
+      group = config.services.nginx.group;
+    };
+  };
+
+  services.nginx = {
+    enable = true;
+
+    virtualHosts.${config.kekleo.domain} = {
+      forceSSL = true;
+      useACMEHost = config.kekleo.domain;
+      locations."/.well-known/".root = config.security.acme.defaults.webroot;
+    };
+  };
 }
diff --git a/nixos/server/vaultwarden.nix b/nixos/server/vaultwarden.nix
index 69bc129..0c5fd86 100644
--- a/nixos/server/vaultwarden.nix
+++ b/nixos/server/vaultwarden.nix
@@ -20,17 +20,16 @@ in
     };
   };
 
-  security.acme = {
-    acceptTerms = true;
-    defaults.email = "admin@${domain}";
-  };
+  security.acme.certs.${domain}.extraDomainNames = [
+    vaultDomain
+  ];
 
   services.nginx = {
     enable = true;
 
     virtualHosts.${vaultDomain} = {
       forceSSL = true;
-      enableACME = true;
+      useACMEHost = config.kekleo.domain;
       locations."/" = {
         proxyPass = "http://127.0.0.1:${toString config.services.vaultwarden.config.ROCKET_PORT}";
         proxyWebsockets = true;