listen for ssl connections to reject

ogdo.nix

@@ -4,7 +4,7 @@
     enable = true;
 
     # ꙮ.run
-    virtualHosts."xn--xx8a.run" = {
+    virtualHosts = let
       listen = [
         {
           addr = "0.0.0.0";
@@ -15,59 +15,48 @@
           addr = "[::]";
         }
         # deliberately avoid listening with https
+        {
+          addr = "0.0.0.0";
+          port = 443;
+          ssl = true;
+        }
+        {
+          port = 443;
+          ssl = true;
+          addr = "[::]";
+        }
       ];
-
       rejectSSL = true;
-      root = "/srv/ogdo";
+    in {
+      "xn--xx8a.run" = {
+        inherit listen rejectSSL;
+        root = "/srv/ogdo";
 
-      extraConfig = ''
-        error_page 404 /;
-        access_log /var/log/nginx/ogdo.log combined;
-        add_header 'Cache-Control' 'no-cache';
-      '';
-
-      locations."/" = { index = "/index.html"; };
-      locations."~ ^/.+" = {
-        root = "/srv/ogdo/served-files";
-        tryFiles = "$uri =404";
         extraConfig = ''
-          default_type application/pdf;
+          error_page 404 /;
+          access_log /var/log/nginx/ogdo.log combined;
+          add_header 'Cache-Control' 'no-cache';
         '';
+
+        locations."/" = { index = "/index.html"; };
+        locations."~ ^/.+" = {
+          root = "/srv/ogdo/served-files";
+          tryFiles = "$uri =404";
+          extraConfig = ''
+            default_type application/pdf;
+          '';
+        };
       };
-    };
 
-    virtualHosts."ogdo.run" = {
+      "ogdo.run" = {
-      listen = [
+        inherit listen rejectSSL;
-        {
+        locations."/".return = "301 http://xn--xx8a.run$request_uri";
-          addr = "0.0.0.0";
+      };
-          port = 80;
-        }
-        {
-          port = 80;
-          addr = "[::]";
-        }
-      ];
 
-      rejectSSL = true;
+      "ꙮ.run" = {
-
+        inherit listen rejectSSL;
-      locations."/".return = "301 http://xn--xx8a.run$request_uri";
+        locations."/".return = "301 http://ogdo.run$request_uri";
-    };
+      };
-
-    virtualHosts."ꙮ.run" = {
-      listen = [
-        {
-          addr = "0.0.0.0";
-          port = 80;
-        }
-        {
-          port = 80;
-          addr = "[::]";
-        }
-      ];
-
-      rejectSSL = true;
-
-      locations."/".return = "301 http://ogdo.run$request_uri";
     };
   };
 }