cgit: client cert auth

1 files changed, 10 insertions, 7 deletions

diff --git a/modules/nixos/services/web/cgit/default.nix b/modules/nixos/services/web/cgit/default.nix
index 2c8139c..e33971e 100644
--- a/modules/nixos/services/web/cgit/default.nix
+++ b/modules/nixos/services/web/cgit/default.nix
@@ -52,8 +52,7 @@ in {
       "private" = {
         enable = true;
         scanPath = cfg.path;
-        nginx.virtualHost = cfg.virtualHost;
-        nginx.location = "/private/";
+        nginx.virtualHost = "private.${cfg.virtualHost}";
 
         user = "git";
         group = "git";
@@ -72,11 +71,15 @@ in {
         "${cfg.virtualHost}" = {
           addSSL = true;
           enableACME = true;
-          locations."/private/" = {
-            basicAuth = {
-              c = "password";
-            };
-          };
+        };
+        "private.${cfg.virtualHost}" = {
+          addSSL = true;
+          enableACME = true;
+
+          extraConfig = ''
+            ssl_client_certificate ${./ca.crt};
+            ssl_verify_client on;
+          '';
         };
       };
     };