feat: promote oauth proxy config to a nginx virtualHosts option

hosts/ward/microvms/adguardhome/default.nix

@@ -24,7 +24,6 @@ in {
   nodes.sentinel = {
     proxiedDomains.adguard = adguardhomeDomain;
 
-    extra.oauth2_proxy.nginx.virtualHosts."${adguardhomeDomain}".allowedGroups = ["adguardhome"];
     services.nginx = {
       upstreams.adguardhome = {
         servers."${config.services.adguardhome.settings.bind_host}:${toString config.services.adguardhome.settings.bind_port}" = {};
@@ -36,8 +35,10 @@ in {
       virtualHosts.${adguardhomeDomain} = {
         forceSSL = true;
         useACMEHost = sentinelCfg.lib.extra.matchingWildcardCert adguardhomeDomain;
+        oauth2.enable = true;
+        oauth2.allowedGroups = ["adguardhome"];
         locations."/" = {
-          proxyPass = "https://adguardhome";
+          proxyPass = "http://adguardhome";
           proxyWebsockets = true;
         };
       };

hosts/ward/microvms/grafana/default.nix

@@ -54,7 +54,7 @@ in {
         forceSSL = true;
         useACMEHost = sentinelCfg.lib.extra.matchingWildcardCert grafanaDomain;
         locations."/" = {
-          proxyPass = "https://grafana";
+          proxyPass = "http://grafana";
           proxyWebsockets = true;
         };
       };

hosts/ward/microvms/loki/default.nix

@@ -45,7 +45,7 @@ in {
         forceSSL = true;
         useACMEHost = sentinelCfg.lib.extra.matchingWildcardCert lokiDomain;
         locations."/" = {
-          proxyPass = "https://loki";
+          proxyPass = "http://loki";
           proxyWebsockets = true;
           extraConfig = ''
             auth_basic "Authentication required";
@@ -58,7 +58,7 @@ in {
           '';
         };
         locations."= /ready" = {
-          proxyPass = "https://loki";
+          proxyPass = "http://loki";
           extraConfig = ''
             auth_basic off;
             access_log off;