102 lines
2.5 KiB
Nix
Executable file
102 lines
2.5 KiB
Nix
Executable file
{ config, pkgs, ... }:
|
|
|
|
{
|
|
sops.secrets = {
|
|
"caddy/secrets.env" = {};
|
|
|
|
"caddy/wo2wz.fyi.crt" = {
|
|
owner = "caddy";
|
|
group = "caddy";
|
|
restartUnits = [ "caddy.service" ];
|
|
};
|
|
"caddy/wo2wz.fyi.key" = {
|
|
owner = "caddy";
|
|
group = "caddy";
|
|
restartUnits = [ "caddy.service" ];
|
|
};
|
|
};
|
|
|
|
services = {
|
|
caddy = {
|
|
enable = true;
|
|
package = pkgs.caddy.withPlugins {
|
|
plugins = [ "github.com/tailscale/caddy-tailscale@v0.0.0-20260106222316-bb080c4414ac" ];
|
|
hash = "sha256-1BAY6oZ1qJCKlh0Y2KKqw87A45EUPVtwS2Su+LfXtCc=";
|
|
};
|
|
environmentFile = config.sops.secrets."caddy/secrets.env".path;
|
|
|
|
# caddy-tailscale breaks reloading
|
|
enableReload = false;
|
|
|
|
extraConfig = ''
|
|
(cloudflare-tls) {
|
|
tls ${config.sops.secrets."caddy/wo2wz.fyi.crt".path} ${config.sops.secrets."caddy/wo2wz.fyi.key".path}
|
|
}
|
|
|
|
(default-settings) {
|
|
encode
|
|
|
|
header {
|
|
Strict-Transport-Security "max-age=15552000;"
|
|
X-Frame-Options "SAMEORIGIN"
|
|
X-Content-Type-Options "nosniff"
|
|
X-Robots-Tag "noindex, nofollow"
|
|
-Server
|
|
-X-Powered-By
|
|
}
|
|
}
|
|
'';
|
|
# have to specify node tags here because if there are two tailscale blocks it just dont work
|
|
globalConfig = ''
|
|
grace_period 30s
|
|
|
|
metrics {
|
|
per_host
|
|
}
|
|
|
|
servers {
|
|
client_ip_headers CF-Connecting-Ip X-Forwarded-For
|
|
trusted_proxies static 127.0.0.1 ::1
|
|
}
|
|
|
|
tailscale {
|
|
auth_key {env.CADDY_TAILSCALE_AUTH_KEY}
|
|
state_dir ${config.services.caddy.dataDir}/caddy-tailscale
|
|
|
|
ephemeral true
|
|
|
|
tags tag:drone
|
|
|
|
grafana {
|
|
tags tag:drone tag:grafana
|
|
}
|
|
jellyfin {
|
|
tags tag:drone tag:jellyfin
|
|
}
|
|
ntfy {
|
|
tags tag:drone tag:ntfy
|
|
}
|
|
prometheus {
|
|
tags tag:drone tag:prometheus
|
|
}
|
|
restic {
|
|
tags tag:drone tag:restic
|
|
}
|
|
technitium {
|
|
tags tag:drone tag:technitium
|
|
}
|
|
vaultwarden {
|
|
tags tag:drone tag:vaultwarden
|
|
}
|
|
}
|
|
'';
|
|
|
|
virtualHosts."wo2wz.fyi".extraConfig = ''
|
|
import default-settings
|
|
import cloudflare-tls
|
|
|
|
respond "{client_ip}"
|
|
'';
|
|
};
|
|
};
|
|
}
|