107 lines
3.2 KiB
Nix
107 lines
3.2 KiB
Nix
{
|
|
config,
|
|
service_configs,
|
|
username,
|
|
pkgs,
|
|
...
|
|
}:
|
|
let
|
|
matrix_hostname = "matrix.${service_configs.https.domain}";
|
|
in
|
|
{
|
|
services.caddy = {
|
|
enable = true;
|
|
email = "titaniumtown@proton.me";
|
|
virtualHosts = {
|
|
${service_configs.https.domain} = {
|
|
extraConfig = ''
|
|
|
|
header /.well-known/matrix/* Content-Type application/json
|
|
header /.well-known/matrix/* Access-Control-Allow-Origin *
|
|
respond /.well-known/matrix/server `{"m.server": "${matrix_hostname}:443"}`
|
|
respond /.well-known/matrix/client `{"m.server":{"base_url":"https://${matrix_hostname}"},"m.homeserver":{"base_url":"https://${matrix_hostname}"},"org.matrix.msc3575.proxy":{"base_url":"https://${config.services.matrix-conduit.settings.global.server_name}"}}`
|
|
|
|
root * ${service_configs.https.data_dir}
|
|
file_server browse
|
|
'';
|
|
|
|
serverAliases = [ "www.${service_configs.https.domain}" ];
|
|
};
|
|
|
|
"immich.${service_configs.https.domain}".extraConfig = ''
|
|
reverse_proxy :${builtins.toString config.services.immich.port}
|
|
'';
|
|
|
|
"jellyfin.${service_configs.https.domain}".extraConfig = ''
|
|
reverse_proxy :${builtins.toString service_configs.ports.jellyfin}
|
|
request_body {
|
|
max_size 4096MB
|
|
}
|
|
'';
|
|
|
|
${service_configs.gitea.domain}.extraConfig = ''
|
|
reverse_proxy :${builtins.toString config.services.gitea.settings.server.HTTP_PORT}
|
|
'';
|
|
|
|
"bitmagnet.${service_configs.https.domain}".extraConfig = ''
|
|
# tls internal
|
|
${import ../secrets/caddy_auth.nix}
|
|
reverse_proxy ${service_configs.https.wg_ip}:${builtins.toString service_configs.ports.bitmagnet}
|
|
'';
|
|
|
|
"torrent.${service_configs.https.domain}".extraConfig = ''
|
|
# tls internal
|
|
${import ../secrets/caddy_auth.nix}
|
|
reverse_proxy ${service_configs.https.wg_ip}:${builtins.toString service_configs.ports.torrent}
|
|
'';
|
|
|
|
"map.${service_configs.https.domain}".extraConfig = ''
|
|
# tls internal
|
|
root * ${service_configs.minecraft.parent_dir}/${service_configs.minecraft.server_name}/squaremap/web
|
|
file_server browse
|
|
'';
|
|
|
|
"${matrix_hostname}".extraConfig = ''
|
|
reverse_proxy :${builtins.toString config.services.matrix-conduit.settings.global.port}
|
|
'';
|
|
|
|
# Exact duplicate of matrix.DOMAIN_NAME
|
|
"${matrix_hostname}:8448".extraConfig =
|
|
config.services.caddy.virtualHosts."${config.services.matrix-conduit.settings.global.server_name
|
|
}".extraConfig;
|
|
};
|
|
};
|
|
|
|
systemd.tmpfiles.rules = [
|
|
"d ${service_configs.https.data_dir} 0750 ${config.services.caddy.user} ${config.services.caddy.group}"
|
|
];
|
|
|
|
systemd.packages = with pkgs; [ nssTools ];
|
|
|
|
networking.firewall.allowedTCPPorts = [
|
|
service_configs.ports.https
|
|
|
|
# http (but really acmeCA challenges)
|
|
80
|
|
|
|
# for matrix federation
|
|
8448
|
|
];
|
|
|
|
networking.firewall.allowedUDPPorts = [
|
|
service_configs.ports.https
|
|
|
|
# for matrix federation
|
|
8448
|
|
];
|
|
|
|
users.users.${config.services.caddy.user}.extraGroups = [
|
|
# for `map.gardling.com`
|
|
"minecraft"
|
|
];
|
|
|
|
users.users.${username}.extraGroups = [
|
|
config.services.caddy.group
|
|
];
|
|
}
|