step-ca config

modules/server/nginx.nix

@@ -73,6 +73,28 @@ in
             client_max_body_size 5G;
           '';
         };
+        "gitea.zeroq.su" = {
+          forceSSL = true;
+          enableACME = true;
+          locations."/" = {
+            proxyPass = "http://${server}:3000";
+            proxyWebsockets = true;
+          };
+          extraConfig = ''
+            client_max_body_size 5G;
+          '';
+        };
+        "ca.zeroq.su" = {
+          forceSSL = false;
+          enableACME = false;
+          locations."/" = {
+            proxyPass = "http://${server}:9000";
+            proxyWebsockets = true;
+          };
+          extraConfig = ''
+            client_max_body_size 5G;
+          '';
+        };
         "gitea.local" = {
           forceSSL = false;
           enableACME = false;
@@ -191,4 +213,14 @@ in
       };
     };
   };
+  security = {
+    acme = {
+      acceptTerms = true;
+      defaults = {
+        email = "oqyude@zeroq.su";
+        server = "https://localhost:9000/acme/acme/directory";
+        dnsProvider = null;
+      };
+    };
+  };
 }

modules/server/secrets/step-ca.yaml

@@ -10,7 +10,7 @@ sops:
             IUYmiWPlPd1IDV1NeMtlSYtO8exzB22XL9DqW4x/tJ7DeSZaBsjcOw==
             -----END AGE ENCRYPTED FILE-----
           recipient: age13l2gtk0nzr484zprp7e0pkrt0ne0j4asyn2pjmlaw73nte7t7d8q4sqtxm
-    lastmodified: "2026-06-13T22:59:34Z"
-    mac: ENC[AES256_GCM,data:72E73xauS1Xrfw6tcyN/PHSJZ4ZZnIeKp8JVUPFGPBvIzaD6ZThYZwQ10FDD4JF+YOwn3QhCEh3t0ozcSNNnJFkyBgSqFtRMkym0ede12VAOPu2wQFoNvMdkT7+n14lJ/9OOz6KDyMf0BQDJKlSfDBkt+mLi61zte5iUxPsWsp4=,iv:xuOwFBEnlRgbaVdMq4O6w9T2edpS6uEPh9yhNbYBJIk=,tag:Y+dtcU17Q83o/9Nt1LGCcg==,type:str]
+    lastmodified: "2026-06-23T20:42:29Z"
+    mac: ENC[AES256_GCM,data:pyayAQOBIBKwfpTCykHtVELGKmhrpS9Mu18wwl3aYyvEwdqqhfSbzt2fXURgWAbrsax6KzrTfi2bgixy8NxRibI+o5/magGAXdk0N5RUP68/FPe1cSL6ZRry+00WjJp8x75wbSp64GU0xY7uUuq+oUKfckGCsY/m4AODbZWU1Ic=,iv:jEpnTyllRd46vPiGG2VlZkFOgwcKQNSov1W813uLQEM=,tag:B7BNlVvhgm9HI/zUQneVQw==,type:str]
     unencrypted_suffix: _unencrypted
     version: 3.13.1

modules/server/step-ca.nix

@@ -22,7 +22,8 @@ in
       key = "${varDir}/secrets/intermediate_ca_key";
       # address = "0.0.0.0:9000";
       dnsNames = [
-        "ca.zeroq.su"
+        "*.zeroq.su"
+        "localhost"
       ];
       db = {
         type = "badgerv2";
@@ -30,6 +31,10 @@ in
       };
       authority = {
         provisioners = [
+          {
+            type = "ACME";
+            name = "acme";
+          }
           {
             type = "JWK";
             name = "oqyude@zeroq.su";