all repos — nixfiles @ 2e2883cbb2f61bfebbad09fa2a082df7375e8fe4

System and user configuration, managed by nix and home-manager

system/settings/services/caddy.nix (view raw)

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
{
  config,
  lib,
  ...
}:
{
  age.secrets = {
    acme.file = ../../../secrets/acme.age;
  };

  users.groups.acme.members = [ "caddy" ];

  security.acme = {
    defaults = {
      reloadServices = [ "caddy" ];

      environmentFile = config.age.secrets.acme.path;
      server = "https://acme-api.actalis.com/acme/directory";
      extraLegoFlags = [ "--eab" ]; # environmentFile must contain LEGO_EAB_KID and LEGO_EAB_HMAC
    };
    acceptTerms = true;
  };

  services.caddy = {
    enable = true;
    openFirewall = true;
    group = "caddy";
    email = config.security.acme.defaults.email;
    acmeCA = config.security.acme.defaults.server;
    globalConfig = ''
      acme_eab {
        key_id {$EAB_KEY_ID}
        mac_key {$EAB_MAC_KEY}
      }
    '';
    virtualHosts = {
      "${config.networking.fqdn}" = {
        extraConfig = lib.mkDefault ''
          respond * 204
        '';
      };
    };
  };
  systemd.services.caddy.serviceConfig = {
    UMask = "007";
    LogsDirectoryMode = "750";
  };
}