derp 4

modules/nixos/services/agenix/default.nix

@@ -58,6 +58,7 @@ in {
       (mkIf cfg.sobotka.enable {
         secrets = {
           cloudflareFirewallApiKey.file = "${self}/secrets/cloudflareFirewallApiKey.age";
+          cloudflareDnsApiToken.file = "${self}/secrets/cloudflareDnsApiToken.age";
           vaultwardenCloudflared.file = "${self}/secrets/vaultwardenCloudflared.age";
           vaultwarden-env.file = "${self}/secrets/vaultwarden-env.age";
         };

modules/server/caddy/default.nix

@@ -12,11 +12,6 @@ in {
     server.caddy.enable = mkEnableOption "Enables caddy";
   };
   config = mkIf cfg.enable {
-    age.secrets.cloudflare-env = {
-      file = "${self}/secrets/cloudflare-env.age";
-      owner = "caddy";
-      mode = "400";
-    };
     networking.firewall = let
       ports = [80 443];
     in {
@@ -24,20 +19,20 @@ in {
       allowedUDPPorts = ports;
     };
 
-    # security.acme = {
-    #   acceptTerms = true;
-    #   defaults.email = config.server.email;
-    #   certs.${config.server.domain} = {
-    #     reloadServices = ["caddy.service"];
-    #     domain = "${config.server.domain}";
-    #     extraDomainNames = ["*.${config.server.domain}"];
-    #     dnsProvider = "cloudflare";
-    #     dnsResolver = "1.1.1.1:53";
-    #     dnsPropagationCheck = true;
-    #     group = config.services.caddy.group;
-    #     environmentFile = config.age.secrets.cloudflare-env.path;
-    #   };
-    # };
+    security.acme = {
+      acceptTerms = true;
+      defaults.email = config.server.email;
+      certs.${config.server.domain} = {
+        reloadServices = ["caddy.service"];
+        domain = "${config.server.domain}";
+        extraDomainNames = ["*.${config.server.domain}"];
+        dnsProvider = "cloudflare";
+        dnsResolver = "1.1.1.1:53";
+        dnsPropagationCheck = true;
+        group = config.services.caddy.group;
+        environmentFile = config.age.secrets.cloudflareDnsApiToken.path;
+      };
+    };
 
     services.caddy = {
       enable = true;

modules/server/vaultwarden/default.nix

@@ -15,7 +15,7 @@ in {
       enable = mkEnableOption "Enables vaultwarden";
       url = lib.mkOption {
         type = lib.types.str;
-        default = "vault.${cfg.domain}";
+        default = "${cfg.domain}";
       };
       cloudflared = {
         credentialsFile = lib.mkOption {