all repos — nixfiles @ 66dd27451f3cd49810550ed67595e9b1f1b6d641

System and user configuration, managed by nix and home-manager

system/settings/services/caddy.nix (view raw)

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
{
  config,
  lib,
  ...
}:
{
  age.secrets = {
    acme.file = ../../../secrets/acme.age;
  };

  users.groups.acme.members = [ "caddy" ];

  security.acme = {
    defaults = {
      reloadServices = [ "caddy" ];

      environmentFile = config.age.secrets.acme.path;
      server = "https://acme-api.actalis.com/acme/directory";
      extraLegoFlags = [ "--eab" ]; # environmentFile must contain LEGO_EAB_KID and LEGO_EAB_HMAC
    };
    acceptTerms = true;
  };

  services.caddy = {
    enable = true;
    openFirewall = true;
    group = "caddy";
    email = config.security.acme.defaults.email;
    acmeCA = config.security.acme.defaults.server;
    globalConfig = ''
      acme_eab {
        key_id {$EAB_KEY_ID}
        mac_key {$EAB_MAC_KEY}
      }
    '';
    virtualHosts = {
      "http://" = {
        # Needed for HTTP->HTTPS servers
      };
      "${config.networking.fqdn}" = {
        serverAliases = [ "https://" ];
        extraConfig = lib.mkDefault ''
          respond * 204
        '';
      };
    };
  };
  systemd.services.caddy.serviceConfig = {
    UMask = "007";
    LogsDirectoryMode = "750";
  };
}