move nginx exclusive virtualHosts to SP modules

sp-modules/bitwarden/module.nix

@@ -69,5 +69,25 @@ in
         <(printf "%s" "$bitwarden_env") ${bitwarden-env}
       '';
     };
+    services.nginx.virtualHosts."password.${sp.domain}" = {
+      sslCertificate = "/var/lib/acme/${sp.domain}/fullchain.pem";
+      sslCertificateKey = "/var/lib/acme/${sp.domain}/key.pem";
+      forceSSL = true;
+      extraConfig = ''
+        add_header Strict-Transport-Security $hsts_header;
+        #add_header Content-Security-Policy "script-src 'self'; object-src 'none'; base-uri 'none';" always;
+        add_header 'Referrer-Policy' 'origin-when-cross-origin';
+        add_header X-Frame-Options DENY;
+        add_header X-Content-Type-Options nosniff;
+        add_header X-XSS-Protection "1; mode=block";
+        proxy_cookie_path / "/; secure; HttpOnly; SameSite=strict";
+        expires 10m;
+      '';
+      locations = {
+        "/" = {
+          proxyPass = "http://127.0.0.1:8222";
+        };
+      };
+    };
   };
 }