129 lines
4.3 KiB
Nix
129 lines
4.3 KiB
Nix
{
|
|
config,
|
|
lib,
|
|
pkgs,
|
|
namespace,
|
|
...
|
|
}:
|
|
with lib;
|
|
let
|
|
name = "caddy";
|
|
cfg = config.${namespace}.services.${name};
|
|
|
|
caddyPackage = pkgs.caddy.withPlugins {
|
|
plugins = [ "github.com/caddy-dns/cloudflare@v0.2.2" ];
|
|
hash = "sha256-dnhEjopeA0UiI+XVYHYpsjcEI6Y1Hacbi28hVKYQURg=";
|
|
};
|
|
|
|
caddy = lib.${namespace}.mkModule {
|
|
inherit config name;
|
|
description = "caddy Service";
|
|
options = { };
|
|
moduleConfig = {
|
|
sops = {
|
|
secrets = {
|
|
"jallen-nas/traefik/crowdsec/lapi-key" = {
|
|
sopsFile = (lib.snowfall.fs.get-file "secrets/nas-secrets.yaml");
|
|
owner = config.users.users.caddy.name;
|
|
group = config.users.users.caddy.group;
|
|
restartUnits = [ "caddy.service" ];
|
|
};
|
|
|
|
"jallen-nas/traefik/crowdsec/capi-machine-id" = {
|
|
sopsFile = (lib.snowfall.fs.get-file "secrets/nas-secrets.yaml");
|
|
owner = config.users.users.caddy.name;
|
|
group = config.users.users.caddy.group;
|
|
restartUnits = [ "caddy.service" ];
|
|
};
|
|
|
|
"jallen-nas/traefik/crowdsec/capi-password" = {
|
|
sopsFile = (lib.snowfall.fs.get-file "secrets/nas-secrets.yaml");
|
|
owner = config.users.users.caddy.name;
|
|
group = config.users.users.caddy.group;
|
|
restartUnits = [ "caddy.service" ];
|
|
};
|
|
"jallen-nas/traefik/cloudflare-dns-api-token" = {
|
|
sopsFile = (lib.snowfall.fs.get-file "secrets/nas-secrets.yaml");
|
|
owner = config.users.users.caddy.name;
|
|
group = config.users.users.caddy.group;
|
|
restartUnits = [ "caddy.service" ];
|
|
};
|
|
"jallen-nas/traefik/cloudflare-zone-api-token" = {
|
|
sopsFile = (lib.snowfall.fs.get-file "secrets/nas-secrets.yaml");
|
|
owner = config.users.users.caddy.name;
|
|
group = config.users.users.caddy.group;
|
|
restartUnits = [ "caddy.service" ];
|
|
};
|
|
"jallen-nas/traefik/cloudflare-api-key" = {
|
|
sopsFile = (lib.snowfall.fs.get-file "secrets/nas-secrets.yaml");
|
|
owner = config.users.users.caddy.name;
|
|
group = config.users.users.caddy.group;
|
|
restartUnits = [ "caddy.service" ];
|
|
};
|
|
"jallen-nas/traefik/cloudflare-email" = {
|
|
sopsFile = (lib.snowfall.fs.get-file "secrets/nas-secrets.yaml");
|
|
owner = config.users.users.caddy.name;
|
|
group = config.users.users.caddy.group;
|
|
restartUnits = [ "caddy.service" ];
|
|
};
|
|
};
|
|
templates = {
|
|
"caddy.env" = {
|
|
content = ''
|
|
CLOUDFLARE_DNS_API_TOKEN=${config.sops.placeholder."jallen-nas/traefik/cloudflare-dns-api-token"}
|
|
CLOUDFLARE_ZONE_API_TOKEN=${config.sops.placeholder."jallen-nas/traefik/cloudflare-zone-api-token"}
|
|
CLOUDFLARE_API_KEY=${config.sops.placeholder."jallen-nas/traefik/cloudflare-api-key"}
|
|
CLOUDFLARE_EMAIL=${config.sops.placeholder."jallen-nas/traefik/cloudflare-email"}
|
|
'';
|
|
owner = config.users.users.caddy.name;
|
|
group = config.users.users.caddy.group;
|
|
restartUnits = [ "caddy.service" ];
|
|
};
|
|
};
|
|
};
|
|
|
|
services.caddy = {
|
|
enable = true;
|
|
package = caddyPackage;
|
|
environmentFile = config.sops.templates."caddy.env".path;
|
|
email = "jalle008@proton.me";
|
|
enableReload = false;
|
|
dataDir = "${cfg.configDir}/caddy";
|
|
globalConfig = ''
|
|
metrics
|
|
http_port 80
|
|
https_port 443
|
|
default_bind 0.0.0.0
|
|
''; # b710da1b0182eadcb1e569408de778f9f3c50
|
|
virtualHosts = {
|
|
"*.mjallen.dev" = {
|
|
extraConfig = ''
|
|
tls {
|
|
dns cloudflare {$CLOUDFLARE_DNS_API_TOKEN}
|
|
}
|
|
|
|
@gitea host gitea.mjallen.dev
|
|
handle @gitea {
|
|
reverse_proxy http://10.0.1.3:3000
|
|
}
|
|
|
|
@jellyfin host jellyfin.mjallen.dev
|
|
handle @jellyfin {
|
|
reverse_proxy http://10.0.1.3:8096
|
|
}
|
|
|
|
@homeassistant host hass.mjallen.dev
|
|
handle @homeassistant {
|
|
reverse_proxy http://10.0.1.4:8123
|
|
}
|
|
'';
|
|
};
|
|
};
|
|
};
|
|
};
|
|
};
|
|
in
|
|
{
|
|
imports = [ caddy ];
|
|
}
|