102 lines
2.6 KiB
Nix
102 lines
2.6 KiB
Nix
{ config
|
|
, pkgs
|
|
, inputs
|
|
, ...
|
|
}: {
|
|
systemd.services.caddy = {
|
|
serviceConfig = {
|
|
# Required to use ports < 1024
|
|
AmbientCapabilities = "cap_net_bind_service";
|
|
CapabilityBoundingSet = "cap_net_bind_service";
|
|
EnvironmentFile = "/etc/secrets/caddy.env";
|
|
TimeoutStartSec = "5m";
|
|
};
|
|
};
|
|
|
|
services.caddy = {
|
|
enable = true;
|
|
email = "ssl@catnip.ee";
|
|
|
|
package = pkgs.caddy.withPlugins {
|
|
# https://github.com/NixOS/nixpkgs/pull/358586#issuecomment-2564016652
|
|
plugins = [
|
|
"github.com/caddy-dns/cloudflare@v0.2.1"
|
|
"github.com/tailscale/caddy-tailscale@v0.0.0-20250207163903-69a970c84556"
|
|
];
|
|
hash = "sha256-cJt3jDXdWsSK5z9yqpUR6hwfxAySVopxmqsm/TVnFIA=";
|
|
};
|
|
|
|
virtualHosts = {
|
|
"kaya.ee".extraConfig = ''
|
|
tls {
|
|
dns cloudflare {env.CLOUDFLARE_API_TOKEN}
|
|
resolvers 1.1.1.1
|
|
}
|
|
|
|
root * ${inputs.kaya-website}
|
|
file_server browse {
|
|
hide .git
|
|
}
|
|
'';
|
|
"http://syncthing.internal".extraConfig = ''
|
|
@local remote_ip private_ranges 100.64.0.0/10
|
|
reverse_proxy @local http://${config.services.syncthing.guiAddress}
|
|
'';
|
|
"http://files.internal".extraConfig = ''
|
|
@local remote_ip private_ranges 100.64.0.0/10
|
|
root * /mnt/media
|
|
file_server @local browse {
|
|
hide .Trash-1000
|
|
}
|
|
'';
|
|
"files.catnip.ee".extraConfig = ''
|
|
tls {
|
|
dns cloudflare {env.CLOUDFLARE_API_TOKEN}
|
|
resolvers 1.1.1.1
|
|
}
|
|
|
|
basic_auth {
|
|
mrow {env.FILES_PASSWORD_HASH}
|
|
}
|
|
|
|
root * /mnt/media
|
|
file_server browse {
|
|
hide .Trash-1000
|
|
}
|
|
'';
|
|
"catnip.ee".extraConfig = ''
|
|
tls {
|
|
dns cloudflare {env.CLOUDFLARE_API_TOKEN}
|
|
resolvers 1.1.1.1
|
|
}
|
|
|
|
root * ${inputs.catnip-website}
|
|
file_server browse {
|
|
hide .git
|
|
}
|
|
|
|
handle /.well-known/matrix/client {
|
|
header Content-Type application/json
|
|
header Access-Control-Allow-Origin *
|
|
respond `{"m.homeserver":{"base_url":"https://matrix.catnip.ee/"}}`
|
|
}
|
|
handle /.well-known/matrix/server {
|
|
header Content-Type application/json
|
|
header Access-Control-Allow-Origin *
|
|
respond `{"m.server": "matrix.catnip.ee:443"}`
|
|
}
|
|
'';
|
|
"www.catnip.ee".extraConfig = ''
|
|
tls {
|
|
dns cloudflare {env.CLOUDFLARE_API_TOKEN}
|
|
resolvers 1.1.1.1
|
|
}
|
|
|
|
redir https://catnip.ee{uri} permanent
|
|
'';
|
|
":80".extraConfig = ''
|
|
respond awawaw
|
|
'';
|
|
};
|
|
};
|
|
}
|