From 5f408cc9568a760405b69ab21866f2693b3f779c Mon Sep 17 00:00:00 2001
From: sid <sid@sid.ovh>
Date: Fri, 3 Apr 2026 15:49:39 +0200
Subject: [PATCH 1/2] intranet uses hetzner instead of webroot

---
 hosts/sid/services/nginx.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/hosts/sid/services/nginx.nix b/hosts/sid/services/nginx.nix
index 2a18722..faceb96 100644
--- a/hosts/sid/services/nginx.nix
+++ b/hosts/sid/services/nginx.nix
@@ -46,6 +46,7 @@ in
   security.acme = {
     certs."${constants.intranet}" = {
       domain = "*.${constants.intranet}";
+      webroot = null;
       dnsProvider = "hetzner";
       credentialsFile = config.sops.secrets.hetzner-dns-api-key.path;
     };

From e74970f1425174385166c6670c41a83e53cc6db4 Mon Sep 17 00:00:00 2001
From: sid <sid@sid.ovh>
Date: Fri, 3 Apr 2026 15:56:27 +0200
Subject: [PATCH 2/2] vaultwarden: disable local nginx

---
 hosts/rx4/services/vaultwarden.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hosts/rx4/services/vaultwarden.nix b/hosts/rx4/services/vaultwarden.nix
index 4a5b191..7d32011 100644
--- a/hosts/rx4/services/vaultwarden.nix
+++ b/hosts/rx4/services/vaultwarden.nix
@@ -15,7 +15,7 @@ in
     dbBackend = "postgresql";
     configurePostgres = true;
 
-    configureNginx = true;
+    configureNginx = false;
     domain = fqdn;
 
     environmentFile = [ config.sops.templates."vaultwarden/env-file".path ];