cert access to homepage

modules/servers/setup.nix

@@ -48,6 +48,10 @@ let
       type = lib.types.bool;
       default = false;
     };
+    certPath = lib.mkOption {
+      type = lib.types.nullOr lib.types.path;
+      default = null;
+    };
   };
   proxy = locations: {
     inherit locations;
@@ -84,6 +88,16 @@ let
         proxy_http_version 1.1;
       '';
     };
+  proxyReversePrivate =
+    cfg:
+    proxyReverse cfg
+    // {
+      extraConfig = ''
+        ssl_verify_client on;
+        ssl_client_certificate ${cfg.certPath};
+        error_page 403 /403.html;
+      '';
+    };
 in
 {
   inherit
@@ -91,5 +105,6 @@ in
     proxy
     proxyReverse
     proxyReverseFix
+    proxyReversePrivate
     ;
 }