feat: use one acme host for the whole domain

nixos/server/default.nix

@@ -50,4 +50,23 @@
       AllowUsers = [ "leonhard" ];
     };
   };
+
+  security.acme = {
+    acceptTerms = true;
+    defaults.email = "admin@${config.kekleo.domain}";
+    defaults.webroot = "/var/lib/acme/acme-challenge/";
+    certs.${config.kekleo.domain} = {
+      group = config.services.nginx.group;
+    };
+  };
+
+  services.nginx = {
+    enable = true;
+
+    virtualHosts.${config.kekleo.domain} = {
+      forceSSL = true;
+      useACMEHost = config.kekleo.domain;
+      locations."/.well-known/".root = config.security.acme.defaults.webroot;
+    };
+  };
 }

nixos/server/vaultwarden.nix

@@ -20,17 +20,16 @@ in
     };
   };
 
-  security.acme = {
-    acceptTerms = true;
-    defaults.email = "admin@${domain}";
-  };
+  security.acme.certs.${domain}.extraDomainNames = [
+    vaultDomain
+  ];
 
   services.nginx = {
     enable = true;
 
     virtualHosts.${vaultDomain} = {
       forceSSL = true;
-      enableACME = true;
+      useACMEHost = config.kekleo.domain;
       locations."/" = {
         proxyPass = "http://127.0.0.1:${toString config.services.vaultwarden.config.ROCKET_PORT}";
         proxyWebsockets = true;