From 73db53426937916050da864ee45e53520da34294 Mon Sep 17 00:00:00 2001
From: William <baduhai@proton.me>
Date: Sat, 8 Nov 2025 21:47:41 -0300
Subject: [PATCH] Switch from wildcard to per-domain SSL certificates

Updated mkNginxVHosts to use per-domain certificates (enableACME) instead
of shared wildcard certificates (useACMEHost). Each service now requests
its own certificate, avoiding conflicts between hosts and following the
principle of least privilege.

Removed wildcard certificate configuration from both alexandria and trantor.
Each host now only obtains certificates for domains it actually serves:
- Alexandria: pass.baduhai.dev, cloud.baduhai.dev, jellyfin.baduhai.dev
- Trantor: git.baduhai.dev
---
 hosts/alexandria/jellyfin.nix    |  1 -
 hosts/alexandria/nextcloud.nix   |  1 -
 hosts/alexandria/nginx.nix       | 11 +++++------
 hosts/alexandria/vaultwarden.nix |  1 -
 utils.nix                        |  7 ++-----
 5 files changed, 7 insertions(+), 14 deletions(-)

diff --git a/hosts/alexandria/jellyfin.nix b/hosts/alexandria/jellyfin.nix
index 9555c89..6ceac09 100644
--- a/hosts/alexandria/jellyfin.nix
+++ b/hosts/alexandria/jellyfin.nix
@@ -10,7 +10,6 @@ in
   };
 
   services.nginx.virtualHosts = mkNginxVHosts {
-    acmeHost = "baduhai.dev";
     domains."jellyfin.baduhai.dev".locations."/".proxyPass = "http://127.0.0.1:8096/";
   };
 }
diff --git a/hosts/alexandria/nextcloud.nix b/hosts/alexandria/nextcloud.nix
index 9e606d9..2368a3c 100644
--- a/hosts/alexandria/nextcloud.nix
+++ b/hosts/alexandria/nextcloud.nix
@@ -76,7 +76,6 @@ in
     };
 
     nginx.virtualHosts = mkNginxVHosts {
-      acmeHost = "baduhai.dev";
       domains."cloud.baduhai.dev" = { };
     };
   };
diff --git a/hosts/alexandria/nginx.nix b/hosts/alexandria/nginx.nix
index 54640c1..6879bfc 100644
--- a/hosts/alexandria/nginx.nix
+++ b/hosts/alexandria/nginx.nix
@@ -19,9 +19,6 @@ in
       dnsProvider = "cloudflare";
       credentialsFile = config.age.secrets.cloudflare.path;
     };
-    certs."baduhai.dev" = {
-      extraDomainNames = [ "*.baduhai.dev" ];
-    };
   };
 
   services.nginx = {
@@ -30,9 +27,11 @@ in
     recommendedOptimisation = true;
     recommendedProxySettings = true;
     recommendedTlsSettings = true;
-    virtualHosts = mkNginxVHosts {
-      acmeHost = "baduhai.dev";
-      domains."_".locations."/".return = "444";
+    virtualHosts = {
+      "_" = {
+        default = true;
+        locations."/".return = "444";
+      };
     };
   };
 
diff --git a/hosts/alexandria/vaultwarden.nix b/hosts/alexandria/vaultwarden.nix
index fd10d6b..2335ee0 100644
--- a/hosts/alexandria/vaultwarden.nix
+++ b/hosts/alexandria/vaultwarden.nix
@@ -20,7 +20,6 @@ in
   };
 
   services.nginx.virtualHosts = mkNginxVHosts {
-    acmeHost = "baduhai.dev";
     domains."pass.baduhai.dev".locations."/".proxyPass =
       "http://${config.services.vaultwarden.config.ROCKET_ADDRESS}:${toString config.services.vaultwarden.config.ROCKET_PORT}/";
   };
diff --git a/utils.nix b/utils.nix
index 740bad0..7a81af7 100644
--- a/utils.nix
+++ b/utils.nix
@@ -183,13 +183,10 @@ in
 
   # Nginx virtual host utilities
   mkNginxVHosts =
-    {
-      acmeHost,
-      domains,
-    }:
+    { domains }:
     let
       commonVHostConfig = {
-        useACMEHost = acmeHost;
+        enableACME = true;
         forceSSL = true;
         kTLS = true;
       };