Re-configure vaultwarden

hosts/nixedo/services/vaultwarden.nix

@@ -1,7 +1,7 @@
 {
   config,
+  inputs,
   lib,
-  options,
   ...
 }:
 
@@ -20,26 +20,6 @@ in
       default = "${service}.${homelab.domain}";
       type = types.str;
     };
-
-    homepage.name = mkOption {
-      default = "Vaultwarden";
-      type = types.str;
-    };
-
-    homepage.description = mkOption {
-      default = "Unofficial Bitwarden compatible server written in Rust";
-      type = types.str;
-    };
-
-    homepage.icon = mkOption {
-      default = "bitwarden";
-      type = types.str;
-    };
-
-    homepage.category = mkOption {
-      default = "Services";
-      type = types.str;
-    };
   };
 
   config = mkIf cfg.enable {
@@ -47,6 +27,8 @@ in
       ${service} = {
         enable = true;
 
+        environmentFile = config.age.secrets.vaultwarden-env.path;
+
         config = {
           DOMAIN = "https://${cfg.url}";
           ROCKET_ADDRESS = "127.0.0.1";
@@ -55,11 +37,17 @@ in
         };
       };
 
-      cloudflared.tunnels.${homelab.cloudflared.tunnelId}.ingress = {
-        "${cfg.url}" = "http://${config.services.${service}.config.ROCKET_ADDRESS}:${
-          toString config.services.${service}.config.ROCKET_PORT
-        }";
+      nginx.virtualHosts.${cfg.url} = {
+        forceSSL = true;
+        useACMEHost = homelab.domain;
+
+        locations."/" = {
+          proxyPass = "http://localhost:${toString config.services.${service}.config.ROCKET_PORT}";
+          recommendedProxySettings = true;
+        };
       };
     };
+
+    age.secrets.vaultwarden-env.file = "${inputs.self}/secrets/vaultwarden-env.age";
   };
 }