From 0fed2374d8d1eb3bca9117f2191a36de1581066b Mon Sep 17 00:00:00 2001
From: Jakub Stachurski <jakub@wilkuu.xyz>
Date: Sun, 7 Jun 2026 20:14:25 +0200
Subject: nginx: Force-Redirect to HTTPS on public sites

---
 hosts/omega-relay/default.nix | 2 +-
 services/bulwark.nix          | 2 +-
 services/freshrss.nix         | 2 +-
 services/mail2.nix            | 4 ++--
 services/uptimekuma.nix       | 2 +-
 services/vaultwarden.nix      | 2 +-
 services/wakapi.nix           | 2 +-
 7 files changed, 8 insertions(+), 8 deletions(-)

diff --git a/hosts/omega-relay/default.nix b/hosts/omega-relay/default.nix
index ba92775..8c5bfbe 100644
--- a/hosts/omega-relay/default.nix
+++ b/hosts/omega-relay/default.nix
@@ -151,7 +151,7 @@
       enable = true;
       virtualHosts."${domain}" = {
         enableACME = !isVM;
-        addSSL = !isVM;
+        forceSSL = !isVM;
         root = "/srv/www/wilkuu.xyz/";
         locations."/" = {
           index = "index.html";
diff --git a/services/bulwark.nix b/services/bulwark.nix
index 00198cd..728139c 100644
--- a/services/bulwark.nix
+++ b/services/bulwark.nix
@@ -126,7 +126,7 @@ in
   };
   config.services.nginx.virtualHosts = lib.mkIf cfg.enable (
     lib.genAttrs cfg.domains (_vhost: {
-      addSSL = cfg.doACME;
+      forceSSL = cfg.doACME;
       enableACME = cfg.doACME;
       locations."/" = {
         proxyPass = "http://127.0.0.1:3081";
diff --git a/services/freshrss.nix b/services/freshrss.nix
index fb20ce8..83a4f07 100644
--- a/services/freshrss.nix
+++ b/services/freshrss.nix
@@ -50,7 +50,7 @@ in
       );
 
       services.nginx.virtualHosts."${cfg.domain}" = {
-        addSSL = cfg.doACME;
+        forceSSL = cfg.doACME;
         enableACME = cfg.doACME;
       };
 
diff --git a/services/mail2.nix b/services/mail2.nix
index b4551cf..ea52388 100644
--- a/services/mail2.nix
+++ b/services/mail2.nix
@@ -126,7 +126,7 @@ in
             [ cfg.defaultDomain ]
           ])
           (_wdomain: {
-            addSSL = lib.mkDefault cfg.doACME;
+            forceSSL = lib.mkDefault cfg.doACME;
             enableACME = lib.mkDefault cfg.doACME;
             locations =
               (proxyWellKnown [
@@ -145,7 +145,7 @@ in
           })
         )
         // (lib.genAttrs [ cfg.defaultDomain ] (_domain: {
-          addSSL = cfg.doACME;
+          forceSSL = cfg.doACME;
           enableACME = cfg.doACME;
           #serverName = "${domain}";
           locations."/" = {
diff --git a/services/uptimekuma.nix b/services/uptimekuma.nix
index f35b469..aa21cc4 100644
--- a/services/uptimekuma.nix
+++ b/services/uptimekuma.nix
@@ -44,7 +44,7 @@ in
     #     }));
 
     services.nginx.virtualHosts."${cfg.domain}" = {
-      addSSL = cfg.doACME;
+      forceSSL = cfg.doACME;
       enableACME = cfg.doACME;
       locations."/" = {
         proxyPass = "http://localhost:3111";
diff --git a/services/vaultwarden.nix b/services/vaultwarden.nix
index ff3466d..551262a 100644
--- a/services/vaultwarden.nix
+++ b/services/vaultwarden.nix
@@ -52,7 +52,7 @@ in
 
       services.nginx.virtualHosts."${cfg.domain}" = {
         enableACME = cfg.doACME;
-        addSSL = cfg.doACME;
+        forceSSL = cfg.doACME;
         locations."/" = {
           proxyPass = "http://localhost:3222";
           recommendedProxySettings = true;
diff --git a/services/wakapi.nix b/services/wakapi.nix
index a350b6a..98c38db 100644
--- a/services/wakapi.nix
+++ b/services/wakapi.nix
@@ -49,7 +49,7 @@ in
 
       services.nginx.virtualHosts."${cfg.domain}" = {
         enableACME = cfg.doACME;
-        addSSL = cfg.doACME;
+        forceSSL = cfg.doACME;
         locations."/" = {
           proxyPass = "http://localhost:3111";
           recommendedProxySettings = true;
-- 
cgit v1.3.1