demiurge: switch back to using self-signed cert instead of step-ca

step-ca was being a massive pain when I switched the domain from
demiurge.vpn to demiurge.epistemia. After a long time of trying to see
why it couldn't connect, it later switched to rejectedIdentifier and I
had no idea how to fix it. (one of the github issues on it had
maintainer saying they're closing due to being unable to reproduce)

5 files changed, 51 insertions, 89 deletions

diff --git a/home.nix b/home.nix
index 3f4a8e1..5a28b30 100644
--- a/home.nix
+++ b/home.nix
@@ -432,7 +432,7 @@ in {
       };
 
       searchEngines = {
-        DEFAULT = "https://searx.demiurge.vpn/search?q={}";
+        DEFAULT = "https://searx.demiurge.epistemia/search?q={}";
         ddg = "https://lite.duckduckgo.com/?q={}";
         nw = "https://wiki.nixos.org/index.php?search={}";
         aw = "https://wiki.archlinux.org/?search={}";
@@ -481,7 +481,7 @@ config.set('content.javascript.enabled', True, 'cloud.binary.ninja')
 config.set('content.javascript.enabled', True, 'console.hetzner.cloud')
 config.set('content.javascript.enabled', True, '*.hetzner.com')
 config.set('content.javascript.enabled', True, '*.digikey.com')
-config.set('content.javascript.enabled', True, '*.demiurge.vpn')
+config.set('content.javascript.enabled', True, '*.demiurge.epistemia')
 
 # Allow locally loaded documents to access remote URLs.
 config.set('content.local_content_can_access_remote_urls', True, 'file:///home/vin/.local/share/qutebrowser/userscripts/*')
@@ -884,15 +884,15 @@ def _pastebin_redir(url: QUrl) -> bool:
 
 # Any return value other than a literal 'False' means we redirected
 REDIRECT_MAP = {
-        "new.reddit.com": operator.methodcaller('setHost', 'redlib.demiurge.vpn'),
-        "np.reddit.com": operator.methodcaller('setHost', 'redlib.demiurge.vpn'),
-        "old.reddit.com": operator.methodcaller('setHost', 'redlib.demiurge.vpn'),
-        "reddit.com": operator.methodcaller('setHost', 'redlib.demiurge.vpn'),
-        "www.reddit.com": operator.methodcaller('setHost', 'redlib.demiurge.vpn'),
-
-    "www.youtube.com": operator.methodcaller('setHost', 'invidious.demiurge.vpn'),
-    "youtube.com": operator.methodcaller('setHost', 'invidious.demiurge.vpn'),
-    "youtu.be": operator.methodcaller('setHost', 'invidious.demiurge.vpn'),
+        "new.reddit.com": operator.methodcaller('setHost', 'redlib.demiurge.epistemia'),
+        "np.reddit.com": operator.methodcaller('setHost', 'redlib.demiurge.epistemia'),
+        "old.reddit.com": operator.methodcaller('setHost', 'redlib.demiurge.epistemia'),
+        "reddit.com": operator.methodcaller('setHost', 'redlib.demiurge.epistemia'),
+        "www.reddit.com": operator.methodcaller('setHost', 'redlib.demiurge.epistemia'),
+
+    "www.youtube.com": operator.methodcaller('setHost', 'invidious.demiurge.epistemia'),
+    "youtube.com": operator.methodcaller('setHost', 'invidious.demiurge.epistemia'),
+    "youtu.be": operator.methodcaller('setHost', 'invidious.demiurge.epistemia'),
 
     "imgur.com": operator.methodcaller('setHost', 'rimgo.bloat.cat'),
     "i.imgur.com": operator.methodcaller('setHost', 'rimgo.bloat.cat'),
diff --git a/hosts/demiurge/default.nix b/hosts/demiurge/default.nix
index 1189a02..52756f1 100644
--- a/hosts/demiurge/default.nix
+++ b/hosts/demiurge/default.nix
@@ -14,12 +14,6 @@
       owner = "root";
       group = "root";
     };
-
-    smallstep = {
-      file = ../../secrets/smallstep.age;
-      owner = "step-ca";
-      group = "step-ca";
-    };
   };
 
   # boot options
@@ -187,12 +181,6 @@
   # };
 
   security = {
-    acme = {
-      acceptTerms = true;
-      defaults.email = "me@vineetk.net";
-      defaults.server = "https://127.0.0.1:4433/acme/acme/directory";
-    };
-
     # I prefer doas over sudo for simplicity
     doas = {
       enable = true;
@@ -206,15 +194,24 @@
     pki.certificates = [
       ''
 -----BEGIN CERTIFICATE-----
-MIIBoDCCAUagAwIBAgIRANI8aOT3LE+pzmsQWjcDOIgwCgYIKoZIzj0EAwIwLjER
-MA8GA1UEChMIZGVtaXVyZ2UxGTAXBgNVBAMTEGRlbWl1cmdlIFJvb3QgQ0EwHhcN
-MjUwMjE4MDUzNTA5WhcNMzUwMjE2MDUzNTA5WjAuMREwDwYDVQQKEwhkZW1pdXJn
-ZTEZMBcGA1UEAxMQZGVtaXVyZ2UgUm9vdCBDQTBZMBMGByqGSM49AgEGCCqGSM49
-AwEHA0IABMv8weeXJSDLygVlBxxAHLCvQCdf2COCk0QffNeDaVlIU/NFo3IyPSqG
-E3YtWEWamU/icgsJS999z3BZ5O+cTP6jRTBDMA4GA1UdDwEB/wQEAwIBBjASBgNV
-HRMBAf8ECDAGAQH/AgEBMB0GA1UdDgQWBBRM51S3OgTxXwNhdSSHw6llz0APFzAK
-BggqhkjOPQQDAgNIADBFAiA9alHJ1XHLlKNRUGRL4tdFC3RZYHtoN8BmBHEfDa1S
-LQIhANgsvYmyCp/Nur2RKaV25CDg3kMYVBXED2HVDy8qa+3i
+MIIDMDCCAhigAwIBAgIUcSUafnojcFKod3f436VELfEKoFkwDQYJKoZIhvcNAQEL
+BQAwHTEbMBkGA1UEAwwSZGVtaXVyZ2UuZXBpc3RlbWlhMB4XDTI1MDMwMzEwMjQw
+OVoXDTI2MDMwMzEwMjQwOVowHTEbMBkGA1UEAwwSZGVtaXVyZ2UuZXBpc3RlbWlh
+MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAwiRlreCXc7f+yWclxR2M
+639g0+Lr/c9HrX7EM2/olavPAtZgCzqqvJsDmXq4AURlwd82wZUZxXjWFwlRji/+
+WViXQBTWwnXVjc9MJlxTq2X2zfU2GIxYsrA1ZQuj0wVHlA+R/66oL0Padc/qQZfv
+sshQnrqnutvGobBWEGJXcCIDiwUGgHlIoelwY9G0GLE/rkVujNjAonyMhVGJHVUv
+lXyc3RNslQHymr4Wl6+lL6V6XfuB1taECJYSLXPx66TvJqod2Io+b7T7cWp+9g9U
+B2jQu1YnPRpwjdPvbOCPjPbOP6UcbyHdbHAidSM0FSL5riVUmugwDwbQKXFFX2gH
+hwIDAQABo2gwZjAfBgNVHREEGDAWghQqLmRlbWl1cmdlLmVwaXN0ZW1pYTATBgNV
+HSUEDDAKBggrBgEFBQcDATAPBgNVHRMECDAGAQH/AgEAMB0GA1UdDgQWBBTjMVhw
+zmkE6P5jFHkLVQE2gNB2ejANBgkqhkiG9w0BAQsFAAOCAQEAWvnwB83vXzQFpObF
+vn/nfZ9wYpNaBsE15ab3Fwd2nDc55KDkDWgBi5Xl8fwN3OhFOU2XXBCYqbCU6asx
+OnSx9glbhJioORO7B5ENbEYrpB97SaWASNXrBQ2KiQT5aC+9xb52K53kkk0tTn2l
+nBb+jyLItzWX99H6EavOq69a4T2BObZaSPQAfpM8FIrKl+UZC3152+bi8wKfG4K4
+FQsOJMjIvhTm2IiOS8xIaZz7EJORxFjtOkLEIGGZBNK6QcnD714/nYbHSrQx4eNM
+/ek8Rmf6DTLaFBx+raWyDTgMY23lvWTKDTT1+dZnRNcg72bFpIdqHsDrIg/IBjZ0
+3eGfkQ==
 -----END CERTIFICATE-----
 ''
     ];
@@ -271,7 +268,7 @@ LQIhANgsvYmyCp/Nur2RKaV25CDg3kMYVBXED2HVDy8qa+3i
     nginx = {
       enable = true;
 
-      defaultListenAddresses = [ "10.0.13.2" ];
+      defaultListenAddresses = [ "100.64.0.5" ];
 
       recommendedGzipSettings = true;
       recommendedOptimisation = true;
@@ -280,26 +277,30 @@ LQIhANgsvYmyCp/Nur2RKaV25CDg3kMYVBXED2HVDy8qa+3i
 
       virtualHosts = {
         "searx.demiurge.epistemia" = {
-          enableACME = true;
-          forceSSL = false;
+          addSSL = true;
+          sslCertificate = "/var/demiurge.epistemia.crt";
+          sslCertificateKey = "/var/demiurge.epistemia.key";
           locations."/".proxyPass = "http://127.0.0.1:8081";
         };
 
         "redlib.demiurge.epistemia" = {
-          enableACME = true;
-          forceSSL = false;
+          addSSL = true;
+          sslCertificate = "/var/demiurge.epistemia.crt";
+          sslCertificateKey = "/var/demiurge.epistemia.key";
           locations."/".proxyPass = "http://127.0.0.1:8082";
         };
 
         "navidrome.demiurge.epistemia" = {
-          enableACME = true;
-          forceSSL = false;
+          addSSL = true;
+          sslCertificate = "/var/demiurge.epistemia.crt";
+          sslCertificateKey = "/var/demiurge.epistemia.key";
           locations."/".proxyPass = "http://127.0.0.1:4533";
         };
 
         "sdui.demiurge.epistemia" = {
-          enableACME = true;
-          forceSSL = false;
+          addSSL = true;
+          sslCertificate = "/var/demiurge.epistemia.crt";
+          sslCertificateKey = "/var/demiurge.epistemia.key";
           locations."/" = {
             proxyPass = "http://127.0.0.1:7860";
             proxyWebsockets = true;
@@ -770,52 +771,6 @@ LQIhANgsvYmyCp/Nur2RKaV25CDg3kMYVBXED2HVDy8qa+3i
       };
     };
 
-    # certificate authority
-    step-ca = {
-      enable = true;
-      address = "127.0.0.1";
-      port = 4433;
-      intermediatePasswordFile = config.age.secrets.smallstep.path;
-
-      settings = {
-        root = "/var/lib/step-ca/certs/root_ca.crt";
-        federatedRoots = null;
-        crt = "/var/lib/step-ca/certs/intermediate_ca.crt";
-        key = "/var/lib/step-ca/secrets/intermediate_ca_key";
-        address = "127.0.0.1:4433";
-        insecureAddress = "";
-        dnsNames = [ "127.0.0.1" ];
-        logger.format = "text";
-
-        db = {
-          type = "badgerv2";
-          dataSource = "/var/lib/step-ca/db";
-          badgerFileLoadingmode = "";
-        };
-
-        authority.provisioners = [{
-          type = "ACME";
-          name = "acme";
-          claims = {
-            enableSSHCA = true;
-            disableRenewal = false;
-            allowRenewalAfterExpiry = false;
-            disableSmallstepExtensions = false;
-          };
-        }];
-
-        tls = {
-          cipherSuites = [
-            "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256"
-            "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256"
-          ];
-          minVersion = 1.2;
-          maxVersion = 1.3;
-          renegotiation = false;
-        };
-      };
-    };
-
     # vpn
     tailscale = {
       enable = true;
diff --git a/hosts/saklas/default.nix b/hosts/saklas/default.nix
index 2c1a2b8..e8a79f6 100644
--- a/hosts/saklas/default.nix
+++ b/hosts/saklas/default.nix
@@ -155,7 +155,15 @@
       port = 8080;
       settings = {
         server_url = "https://headscale.13f0.net";
-        dns.base_domain = "epistemia";
+        dns = {
+          base_domain = "epistemia";
+          extra_records = [
+            { name = "navidrome.demiurge.epistemia"; type = "A"; value = "100.64.0.5"; }
+            { name = "redlib.demiurge.epistemia"; type = "A"; value = "100.64.0.5"; }
+            { name = "sdui.demiurge.epistemia"; type = "A"; value = "100.64.0.5"; }
+            { name = "searx.demiurge.epistemia"; type = "A"; value = "100.64.0.5"; }
+          ];
+        };
         logtail.enabled = false;
       };
     };
diff --git a/secrets/secrets.nix b/secrets/secrets.nix
index 69036d5..e42d9d5 100644
--- a/secrets/secrets.nix
+++ b/secrets/secrets.nix
@@ -13,7 +13,6 @@ in
 
   "hetzner_dns.age".publicKeys = users ++ [ saklas ];
   "radicale_users.age".publicKeys = users ++ [ saklas ];
-  "smallstep.age".publicKeys = users ++ [ demiurge ];
   "tailscale_demiurge.age".publicKeys = users ++ [ demiurge ];
   "tailscale_saklas.age".publicKeys = users ++ [ saklas ];
 }
diff --git a/secrets/smallstep.age b/secrets/smallstep.age
deleted file mode 100644
index 842bd86..0000000
--- a/secrets/smallstep.age
+++ /dev/null