demiurge: switch back to using self-signed cert instead of step-ca

step-ca was being a massive pain when I switched the domain from
demiurge.vpn to demiurge.epistemia. After a long time of trying to see
why it couldn't connect, it later switched to rejectedIdentifier and I
had no idea how to fix it. (one of the github issues on it had
maintainer saying they're closing due to being unable to reproduce)

2 files changed, 40 insertions, 77 deletions

diff --git a/hosts/demiurge/default.nix b/hosts/demiurge/default.nix
index 1189a02..52756f1 100644
--- a/hosts/demiurge/default.nix
+++ b/hosts/demiurge/default.nix
@@ -14,12 +14,6 @@
       owner = "root";
       group = "root";
     };
-
-    smallstep = {
-      file = ../../secrets/smallstep.age;
-      owner = "step-ca";
-      group = "step-ca";
-    };
   };
 
   # boot options
@@ -187,12 +181,6 @@
   # };
 
   security = {
-    acme = {
-      acceptTerms = true;
-      defaults.email = "me@vineetk.net";
-      defaults.server = "https://127.0.0.1:4433/acme/acme/directory";
-    };
-
     # I prefer doas over sudo for simplicity
     doas = {
       enable = true;
@@ -206,15 +194,24 @@
     pki.certificates = [
       ''
 -----BEGIN CERTIFICATE-----
-MIIBoDCCAUagAwIBAgIRANI8aOT3LE+pzmsQWjcDOIgwCgYIKoZIzj0EAwIwLjER
-MA8GA1UEChMIZGVtaXVyZ2UxGTAXBgNVBAMTEGRlbWl1cmdlIFJvb3QgQ0EwHhcN
-MjUwMjE4MDUzNTA5WhcNMzUwMjE2MDUzNTA5WjAuMREwDwYDVQQKEwhkZW1pdXJn
-ZTEZMBcGA1UEAxMQZGVtaXVyZ2UgUm9vdCBDQTBZMBMGByqGSM49AgEGCCqGSM49
-AwEHA0IABMv8weeXJSDLygVlBxxAHLCvQCdf2COCk0QffNeDaVlIU/NFo3IyPSqG
-E3YtWEWamU/icgsJS999z3BZ5O+cTP6jRTBDMA4GA1UdDwEB/wQEAwIBBjASBgNV
-HRMBAf8ECDAGAQH/AgEBMB0GA1UdDgQWBBRM51S3OgTxXwNhdSSHw6llz0APFzAK
-BggqhkjOPQQDAgNIADBFAiA9alHJ1XHLlKNRUGRL4tdFC3RZYHtoN8BmBHEfDa1S
-LQIhANgsvYmyCp/Nur2RKaV25CDg3kMYVBXED2HVDy8qa+3i
+MIIDMDCCAhigAwIBAgIUcSUafnojcFKod3f436VELfEKoFkwDQYJKoZIhvcNAQEL
+BQAwHTEbMBkGA1UEAwwSZGVtaXVyZ2UuZXBpc3RlbWlhMB4XDTI1MDMwMzEwMjQw
+OVoXDTI2MDMwMzEwMjQwOVowHTEbMBkGA1UEAwwSZGVtaXVyZ2UuZXBpc3RlbWlh
+MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAwiRlreCXc7f+yWclxR2M
+639g0+Lr/c9HrX7EM2/olavPAtZgCzqqvJsDmXq4AURlwd82wZUZxXjWFwlRji/+
+WViXQBTWwnXVjc9MJlxTq2X2zfU2GIxYsrA1ZQuj0wVHlA+R/66oL0Padc/qQZfv
+sshQnrqnutvGobBWEGJXcCIDiwUGgHlIoelwY9G0GLE/rkVujNjAonyMhVGJHVUv
+lXyc3RNslQHymr4Wl6+lL6V6XfuB1taECJYSLXPx66TvJqod2Io+b7T7cWp+9g9U
+B2jQu1YnPRpwjdPvbOCPjPbOP6UcbyHdbHAidSM0FSL5riVUmugwDwbQKXFFX2gH
+hwIDAQABo2gwZjAfBgNVHREEGDAWghQqLmRlbWl1cmdlLmVwaXN0ZW1pYTATBgNV
+HSUEDDAKBggrBgEFBQcDATAPBgNVHRMECDAGAQH/AgEAMB0GA1UdDgQWBBTjMVhw
+zmkE6P5jFHkLVQE2gNB2ejANBgkqhkiG9w0BAQsFAAOCAQEAWvnwB83vXzQFpObF
+vn/nfZ9wYpNaBsE15ab3Fwd2nDc55KDkDWgBi5Xl8fwN3OhFOU2XXBCYqbCU6asx
+OnSx9glbhJioORO7B5ENbEYrpB97SaWASNXrBQ2KiQT5aC+9xb52K53kkk0tTn2l
+nBb+jyLItzWX99H6EavOq69a4T2BObZaSPQAfpM8FIrKl+UZC3152+bi8wKfG4K4
+FQsOJMjIvhTm2IiOS8xIaZz7EJORxFjtOkLEIGGZBNK6QcnD714/nYbHSrQx4eNM
+/ek8Rmf6DTLaFBx+raWyDTgMY23lvWTKDTT1+dZnRNcg72bFpIdqHsDrIg/IBjZ0
+3eGfkQ==
 -----END CERTIFICATE-----
 ''
     ];
@@ -271,7 +268,7 @@ LQIhANgsvYmyCp/Nur2RKaV25CDg3kMYVBXED2HVDy8qa+3i
     nginx = {
       enable = true;
 
-      defaultListenAddresses = [ "10.0.13.2" ];
+      defaultListenAddresses = [ "100.64.0.5" ];
 
       recommendedGzipSettings = true;
       recommendedOptimisation = true;
@@ -280,26 +277,30 @@ LQIhANgsvYmyCp/Nur2RKaV25CDg3kMYVBXED2HVDy8qa+3i
 
       virtualHosts = {
         "searx.demiurge.epistemia" = {
-          enableACME = true;
-          forceSSL = false;
+          addSSL = true;
+          sslCertificate = "/var/demiurge.epistemia.crt";
+          sslCertificateKey = "/var/demiurge.epistemia.key";
           locations."/".proxyPass = "http://127.0.0.1:8081";
         };
 
         "redlib.demiurge.epistemia" = {
-          enableACME = true;
-          forceSSL = false;
+          addSSL = true;
+          sslCertificate = "/var/demiurge.epistemia.crt";
+          sslCertificateKey = "/var/demiurge.epistemia.key";
           locations."/".proxyPass = "http://127.0.0.1:8082";
         };
 
         "navidrome.demiurge.epistemia" = {
-          enableACME = true;
-          forceSSL = false;
+          addSSL = true;
+          sslCertificate = "/var/demiurge.epistemia.crt";
+          sslCertificateKey = "/var/demiurge.epistemia.key";
           locations."/".proxyPass = "http://127.0.0.1:4533";
         };
 
         "sdui.demiurge.epistemia" = {
-          enableACME = true;
-          forceSSL = false;
+          addSSL = true;
+          sslCertificate = "/var/demiurge.epistemia.crt";
+          sslCertificateKey = "/var/demiurge.epistemia.key";
           locations."/" = {
             proxyPass = "http://127.0.0.1:7860";
             proxyWebsockets = true;
@@ -770,52 +771,6 @@ LQIhANgsvYmyCp/Nur2RKaV25CDg3kMYVBXED2HVDy8qa+3i
       };
     };
 
-    # certificate authority
-    step-ca = {
-      enable = true;
-      address = "127.0.0.1";
-      port = 4433;
-      intermediatePasswordFile = config.age.secrets.smallstep.path;
-
-      settings = {
-        root = "/var/lib/step-ca/certs/root_ca.crt";
-        federatedRoots = null;
-        crt = "/var/lib/step-ca/certs/intermediate_ca.crt";
-        key = "/var/lib/step-ca/secrets/intermediate_ca_key";
-        address = "127.0.0.1:4433";
-        insecureAddress = "";
-        dnsNames = [ "127.0.0.1" ];
-        logger.format = "text";
-
-        db = {
-          type = "badgerv2";
-          dataSource = "/var/lib/step-ca/db";
-          badgerFileLoadingmode = "";
-        };
-
-        authority.provisioners = [{
-          type = "ACME";
-          name = "acme";
-          claims = {
-            enableSSHCA = true;
-            disableRenewal = false;
-            allowRenewalAfterExpiry = false;
-            disableSmallstepExtensions = false;
-          };
-        }];
-
-        tls = {
-          cipherSuites = [
-            "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256"
-            "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256"
-          ];
-          minVersion = 1.2;
-          maxVersion = 1.3;
-          renegotiation = false;
-        };
-      };
-    };
-
     # vpn
     tailscale = {
       enable = true;
diff --git a/hosts/saklas/default.nix b/hosts/saklas/default.nix
index 2c1a2b8..e8a79f6 100644
--- a/hosts/saklas/default.nix
+++ b/hosts/saklas/default.nix
@@ -155,7 +155,15 @@
       port = 8080;
       settings = {
         server_url = "https://headscale.13f0.net";
-        dns.base_domain = "epistemia";
+        dns = {
+          base_domain = "epistemia";
+          extra_records = [
+            { name = "navidrome.demiurge.epistemia"; type = "A"; value = "100.64.0.5"; }
+            { name = "redlib.demiurge.epistemia"; type = "A"; value = "100.64.0.5"; }
+            { name = "sdui.demiurge.epistemia"; type = "A"; value = "100.64.0.5"; }
+            { name = "searx.demiurge.epistemia"; type = "A"; value = "100.64.0.5"; }
+          ];
+        };
         logtail.enabled = false;
       };
     };