123 lines
3.4 KiB
Nix
123 lines
3.4 KiB
Nix
{ config, pkgs, ... }:
|
|
|
|
{
|
|
services = {
|
|
caddy = {
|
|
enable = true;
|
|
package = pkgs.caddy.withPlugins {
|
|
plugins = [ "github.com/WeidiDeng/caddy-cloudflare-ip@v0.0.0-20231130002422-f53b62aa13cb"];
|
|
hash = "sha256-UhQOGV0149dK4u9mr449aohfG3KKwSDRW9WrvT0uOKI=";
|
|
};
|
|
extraConfig = ''
|
|
(cloudflare-tls) {
|
|
tls ${config.sops.secrets."caddy/wo2wz.fyi.crt".path} ${config.sops.secrets."caddy/wo2wz.fyi.key".path}
|
|
}
|
|
|
|
(default-settings) {
|
|
encode
|
|
|
|
header {
|
|
Strict-Transport-Security "max-age=15552000;"
|
|
X-Frame-Options "SAMEORIGIN"
|
|
X-Content-Type-Options "nosniff"
|
|
X-Robots-Tag "noindex, nofollow"
|
|
-Server
|
|
-X-Powered-By
|
|
}
|
|
}
|
|
'';
|
|
globalConfig = ''
|
|
grace_period 30s
|
|
servers {
|
|
client_ip_headers CF-Connecting-Ip X-Forwarded-For
|
|
trusted_proxies cloudflare {
|
|
interval 7d
|
|
timeout 15s
|
|
}
|
|
trusted_proxies_strict
|
|
}
|
|
'';
|
|
virtualHosts = {
|
|
"drone.taild5f7e6.ts.net".extraConfig = ''
|
|
import default-settings
|
|
|
|
# block connections to admin login
|
|
respond /admin/* 403
|
|
|
|
reverse_proxy localhost:8000
|
|
'';
|
|
|
|
"wo2wz.fyi".extraConfig = ''
|
|
import default-settings
|
|
import cloudflare-tls
|
|
|
|
respond "not much to see here"
|
|
'';
|
|
|
|
"authentik.wo2wz.fyi".extraConfig = ''
|
|
import default-settings
|
|
import cloudflare-tls
|
|
|
|
reverse_proxy localhost:9000
|
|
'';
|
|
|
|
"nextcloud.wo2wz.fyi".extraConfig = ''
|
|
import default-settings
|
|
|
|
root ${config.services.nginx.virtualHosts."localhost:8002".root}
|
|
file_server
|
|
|
|
php_fastcgi unix/${config.services.phpfpm.pools.nextcloud.socket}
|
|
|
|
redir /.well-known/carddav /remote.php/dav 301
|
|
redir /.well-known/caldav /remote.php/dav 301
|
|
redir /.well-known/webfinger /index.php/webfinger 301
|
|
redir /.well-known/nodeinfo /index.php/nodeinfo 301
|
|
redir /.well-known/* /index.php{uri} 301
|
|
redir /remote/* /remote.php{uri} 301
|
|
|
|
@forbidden {
|
|
path /build/* /tests/* /config/* /lib/* /3rdparty/* /templates/* /data/*
|
|
path /.* /autotest* /occ* /issue* /indie* /db_* /console*
|
|
not path /.well-known/*
|
|
}
|
|
|
|
respond @forbidden 403
|
|
|
|
# make .mjs javascript work for the functionality of some buttons/apps
|
|
@mjs path *.mjs
|
|
header @mjs Content-Type application/javascript
|
|
'';
|
|
|
|
"onlyoffice.wo2wz.fyi".extraConfig = ''
|
|
import default-settings
|
|
import cloudflare-tls
|
|
|
|
@blockinternal {
|
|
path /internal/*
|
|
path /info/*
|
|
not remote_ip 127.0.0.1
|
|
}
|
|
respond @blockinternal 403
|
|
|
|
reverse_proxy localhost:8003
|
|
'';
|
|
|
|
"uptime-kuma.wo2wz.fyi".extraConfig = ''
|
|
import default-settings
|
|
import cloudflare-tls
|
|
|
|
reverse_proxy localhost:8005
|
|
'';
|
|
|
|
"zipline.wo2wz.fyi".extraConfig = ''
|
|
import default-settings
|
|
import cloudflare-tls
|
|
|
|
reverse_proxy localhost:8001
|
|
'';
|
|
};
|
|
};
|
|
tailscale.permitCertUid = "caddy"; # allow caddy to manage tailscale ssl certs
|
|
};
|
|
}
|