server.nix/caddy/default.nix

{ config
, pkgs
, inputs
, settings
, ...
}:
let
  elementClient = pkgs.element-web.override {
    conf = {
      default_server_config.default_server_name = "catnip.ee";
      element_call.use_exclusively = true;

      features = {
        feature_video_rooms = true;
        feature_element_call_video_rooms = true;
      };
    };
  };

  synapse-admin = pkgs.synapse-admin.override {
    baseUrl = "https://matrix.catnip.ee";
  };
in
{
  systemd.services.caddy = {
    serviceConfig = {
      # Required to use ports < 1024
      AmbientCapabilities = "cap_net_bind_service";
      CapabilityBoundingSet = "cap_net_bind_service";
      EnvironmentFile = "/etc/secrets/caddy.env";
      TimeoutStartSec = "5m";
    };
  };

  services.caddy = {
    enable = true;
    email = "ssl@catnip.ee";

    package = (pkgs.callPackage ./custom-caddy.nix {
      plugins = [ "github.com/caddy-dns/cloudflare" ];
    });

    virtualHosts = {
      "xn--tdaa.ee" = {
        extraConfig = ''
          tls {
            dns cloudflare {env.CLOUDFLARE_API_TOKEN}
            resolvers 1.1.1.1
          }

          root * ${inputs.xn--tdaa-website}
          file_server browse {
            hide .git
          }
        '';
        serverAliases = [ "üü.ee" ];
        logFormat = ''
          output file ${config.services.caddy.logDir}/access.log {
            mode 640
          }
        '';
      };
      "kaya.ee" = {
        extraConfig = ''
          tls {
            dns cloudflare {env.CLOUDFLARE_API_TOKEN}
            resolvers 1.1.1.1
          }

          respond owo
        '';

        logFormat = ''
          output file ${config.services.caddy.logDir}/access.log {
            mode 640
          }
        '';
      };
   
      "lastfm.catnip.ee" = {
        extraConfig = ''
          tls {
            dns cloudflare {env.CLOUDFLARE_API_TOKEN}
            resolvers 1.1.1.1
          }

          reverse_proxy :${toString config.services.lastfm-status.port}
        '';
        logFormat = ''
          output file ${config.services.caddy.logDir}/access.log {
            mode 640
          }
        '';
      };

      "http://syncthing.internal".extraConfig = ''
        @local remote_ip private_ranges 100.64.0.0/10
        reverse_proxy @local http://${config.services.syncthing.guiAddress}
      '';
      "http://epic.internal".extraConfig = ''
        @local remote_ip private_ranges 100.64.0.0/10
        reverse_proxy @local :${toString settings.ports.epicgames-freegames-node}
      '';
      "http://bazarr.internal".extraConfig = ''
        @local remote_ip private_ranges 100.64.0.0/10
        reverse_proxy @local :${toString config.services.bazarr.listenPort}
      '';
      "http://scrutiny.internal".extraConfig = ''
        @local remote_ip private_ranges 100.64.0.0/10
        reverse_proxy @local :${toString config.services.scrutiny.settings.web.listen.port}
      '';
      "http://prowlarr.internal".extraConfig = ''
        @local remote_ip private_ranges 100.64.0.0/10
        reverse_proxy @local :${toString settings.ports.prowlarr}
      '';
      "http://radarr.internal".extraConfig = ''
        @local remote_ip private_ranges 100.64.0.0/10
        reverse_proxy @local :${toString settings.ports.radarr}
      '';
      "http://sonarr.internal".extraConfig = ''
        @local remote_ip private_ranges 100.64.0.0/10
        reverse_proxy @local :${toString settings.ports.sonarr}
      '';
      "http://lidarr.internal".extraConfig = ''
        @local remote_ip private_ranges 100.64.0.0/10
        reverse_proxy @local :${toString settings.ports.lidarr}
      '';
      "http://qbittorrent.internal".extraConfig = ''
        @local remote_ip private_ranges 100.64.0.0/10
        reverse_proxy @local :${toString settings.ports.qbittorrent}
      '';
      "http://files.internal".extraConfig = ''
        @local remote_ip private_ranges 100.64.0.0/10
        root * /mnt/media
        file_server @local browse {
          hide .Trash-1000
        }
      '';

      "files.catnip.ee" = {
        extraConfig = ''
          tls {
            dns cloudflare {env.CLOUDFLARE_API_TOKEN}
            resolvers 1.1.1.1
          }

          basic_auth {
           mrow {env.FILES_PASSWORD_HASH}
          }

          root * /mnt/media
          file_server browse {
            hide .Trash-1000
          }
        '';
        logFormat = ''
          output file ${config.services.caddy.logDir}/access.log {
            mode 640
          }
        '';
      };

      "chat.catnip.ee".extraConfig = ''
        tls {
          dns cloudflare {env.CLOUDFLARE_API_TOKEN}
          resolvers 1.1.1.1
        }

        root * ${elementClient}
        file_server
      '';
      "synapse-admin.catnip.ee".extraConfig = ''
        tls {
          dns cloudflare {env.CLOUDFLARE_API_TOKEN}
          resolvers 1.1.1.1
        }

        root * ${synapse-admin}
        file_server
      '';
      "matrix.catnip.ee" = {
        extraConfig = ''
          tls {
            dns cloudflare {env.CLOUDFLARE_API_TOKEN}
            resolvers 1.1.1.1
          }

          reverse_proxy :${toString settings.ports.synapse}

          redir /telegram /telegram/

          handle /.well-known/matrix/client {
            header Content-Type application/json
            header Access-Control-Allow-Origin *
            respond `{"m.homeserver":{"base_url":"https://matrix.catnip.ee/"},"org.matrix.msc3575.proxy":{"url":"https://sliding-sync.catnip.ee"}}`
          }
          handle /.well-known/matrix/server {
            header Content-Type application/json
            header Access-Control-Allow-Origin *
            respond `{"m.server": "matrix.catnip.ee:443"}`
          }

          handle /telegram/* {
            reverse_proxy :${toString settings.ports.mautrix-telegram}
          }
        '';
        logFormat = ''
          output file ${config.services.caddy.logDir}/access.log {
            mode 640
          }
        '';
      };

      "catnip.ee" = {
        extraConfig = ''
          tls {
            dns cloudflare {env.CLOUDFLARE_API_TOKEN}
            resolvers 1.1.1.1
          }

          root * ${inputs.catnip-website}
          file_server browse {
            hide .git
          }

          handle /.well-known/matrix/client {
            header Content-Type application/json
            header Access-Control-Allow-Origin *
            respond `{"m.homeserver":{"base_url":"https://matrix.catnip.ee/"},"org.matrix.msc3575.proxy":{"url":"https://sliding-sync.catnip.ee"}}`
          }
          handle /.well-known/matrix/server {
            header Content-Type application/json
            header Access-Control-Allow-Origin *
            respond `{"m.server": "matrix.catnip.ee:443"}`
          }
        '';
        logFormat = ''
          output file ${config.services.caddy.logDir}/access.log {
            mode 640
          }
        '';
      };
      "www.catnip.ee" = {
        extraConfig = ''
          tls {
            dns cloudflare {env.CLOUDFLARE_API_TOKEN}
            resolvers 1.1.1.1
          }

          redir https://catnip.ee{uri} permanent
        '';
        logFormat = ''
          output file ${config.services.caddy.logDir}/access.log {
            mode 640
          }
        '';
      };

      "confess.catnip.ee" = {
        extraConfig = ''
          tls {
            dns cloudflare {env.CLOUDFLARE_API_TOKEN}
            resolvers 1.1.1.1
          }

          reverse_proxy :${toString config.services.confess-web.port}
        '';
        logFormat = ''
          output file ${config.services.caddy.logDir}/access.log {
            mode 640
          }
        '';
      };

      ":80".extraConfig = ''
        respond awawaw
      '';
    };
  };
}