From 55dac18cf1d394adb2fcb501c685250471892a2c Mon Sep 17 00:00:00 2001
From: Lorenz Leutgeb <lorenz@leutgeb.xyz>
Date: Tue, 14 Oct 2025 19:24:34 +0200
Subject: [PATCH] nginx: Force TLS

---
 os/host/seed/attic.nix             | 2 +-
 os/host/seed/bootstrap/default.nix | 2 +-
 os/host/seed/files.nix             | 2 +-
 os/host/seed/grafana.nix           | 2 +-
 os/mixin/radicle.nix               | 2 +-
 5 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/os/host/seed/attic.nix b/os/host/seed/attic.nix
index d96ffd9..283b509 100644
--- a/os/host/seed/attic.nix
+++ b/os/host/seed/attic.nix
@@ -28,8 +28,8 @@ in {
       };
     };
     nginx.virtualHosts.${domain} = {
-      addSSL = true;
       enableACME = true;
+      forceSSL = true;
       serverName = domain;
       locations."/" = {
         proxyPass = "http://127.0.0.1:${builtins.toString port}";
diff --git a/os/host/seed/bootstrap/default.nix b/os/host/seed/bootstrap/default.nix
index ea9ae71..4af09e8 100644
--- a/os/host/seed/bootstrap/default.nix
+++ b/os/host/seed/bootstrap/default.nix
@@ -36,8 +36,8 @@
     };
   };
   services.nginx.virtualHosts."bootstrap.radicle.xyz" = {
-    addSSL = true;
     enableACME = true;
+    forceSSL = true;
     serverName = "bootstrap.radicle.xyz";
     root = "/var/www/bootstrap.radicle.xyz";
     locations."/".extraConfig = ''
diff --git a/os/host/seed/files.nix b/os/host/seed/files.nix
index 199c9b7..6a6145e 100644
--- a/os/host/seed/files.nix
+++ b/os/host/seed/files.nix
@@ -13,8 +13,8 @@ in {
       add_header 'Access-Control-Allow-Origin' '*';
       autoindex on;
     '';
-    addSSL = true;
     enableACME = true;
+    forceSSL = true;
     serverName = name;
   };
 
diff --git a/os/host/seed/grafana.nix b/os/host/seed/grafana.nix
index 3784359..1da36ad 100644
--- a/os/host/seed/grafana.nix
+++ b/os/host/seed/grafana.nix
@@ -19,8 +19,8 @@ in {
     };
 
     nginx.virtualHosts.${domain} = {
-      addSSL = true;
       enableACME = true;
+      forceSSL = true;
       serverName = domain;
       locations."/" = {
         proxyPass = "http://127.0.0.1:${builtins.toString port}";
diff --git a/os/mixin/radicle.nix b/os/mixin/radicle.nix
index 380374c..b729801 100644
--- a/os/mixin/radicle.nix
+++ b/os/mixin/radicle.nix
@@ -60,8 +60,8 @@
     httpd = {
       enable = true;
       nginx = {
-        addSSL = true;
         enableACME = true;
+	forceSSL = true;
         serverName = config.networking.fqdn;
       };
     };