added secureHost flag

modules/servers/flame.nix

@@ -2,7 +2,7 @@
 let
   cfg = config.my.servers.flame;
   cfgS = config.my.servers.flameSecret;
-  enable = cfg.enable || cfgS.enable;
+  enable = (cfg.enable || cfgS.enable) && config.my.secureHost;
   setup = import ./setup.nix { inherit lib config; };
 in
 {
@@ -10,12 +10,14 @@ in
     flame = setup.mkOptions "flame" "start" 5005;
     flameSecret = setup.mkOptions "flameSecret" "qampqwn4wprhqny8h8zj" 5007;
   };
-  config = {
+  config = lib.mkIf enable {
     networking.firewall.allowedTCPPorts = lib.mkIf (!cfg.isLocal || !cfgS.isLocal) [
       cfg.port
       cfgS.port
     ];
-    sops.secrets = lib.mkIf enable { flame.sopsFile = ../../secrets/env.yaml; };
+    sops.secrets = {
+      flame.sopsFile = ../../secrets/env.yaml;
+    };
     virtualisation.oci-containers.containers = lib.mkIf enable {
       flame = lib.mkIf cfg.enable {
         autoStart = true;
@@ -45,11 +47,9 @@ in
         };
       };
     };
-    services.nginx = {
-      virtualHosts = lib.mkIf (cfg.enableProxy || cfgS.enableProxy) {
-        "${cfg.host}" = setup.proxyReverse cfg;
-        "${cfgS.host}" = setup.proxyReverse cfgS;
-      };
+    services.nginx.virtualHosts = lib.mkIf enable {
+      "${cfg.host}" = lib.mkIf cfg.enableProxy (setup.proxyReverse cfg);
+      "${cfgS.host}" = lib.mkIf cfgS.enableProxy (setup.proxyReverse cfgS);
     };
   };
 }