2 files changed, 15 insertions, 1 deletions
diff --git a/sys/web/nginx.nix b/sys/web/nginx.nix
index ba1f430..ab5ccde 100644
--- a/sys/web/nginx.nix
+++ b/sys/web/nginx.nix
@@ -7,6 +7,10 @@ in
   options.local.web = {
     enable = mkEnableOption "web server";
 
+    defaultACMEHost = mkOption {
+      type = types.str;
+    };
+
     ownedCerts = mkOption {
       type = with lib.types; listOf str;
       default = [ ];
@@ -46,7 +50,16 @@ in
         sslDhparam = config.security.dhparams.params.nginx.path;
         clientMaxBodySize = "42M";
 
-        virtualHosts = { };
+        virtualHosts.default = {
+          default = true;
+
+          addSSL = true;
+          useACMEHost = cfg.defaultACMEHost;
+
+          extraConfig = ''
+            return 403;
+          '';
+        };
       };
     };
 
diff --git a/sys/web/sites/portal.nix b/sys/web/sites/portal.nix
index e46a9b1..c95e2ea 100644
--- a/sys/web/sites/portal.nix
+++ b/sys/web/sites/portal.nix
@@ -12,6 +12,7 @@ in
     local.web = {
       enable = mkDefault true;
       ownedCerts = [ "host" ];
+      defaultACMEHost = domains.host.main;
     };
 
     services.nginx.virtualHosts.${domains.host.www} = {