all repos — nixfiles @ 4a94984718a95c35b80eba4b875e7f9f75826928

System and user configuration, managed by nix and home-manager

caddy: move caddy secrets to reverse proxy config

Alin
commit

4a94984718a95c35b80eba4b875e7f9f75826928

parent

4b40fa9ece26c606abe7b405b4cd56c897a14b21

2 files changed, 7 insertions(+), 3 deletions(-)

changed files
M system/roles/reverse-proxy.nix → system/roles/reverse-proxy.nix
@@ -1,4 +1,5 @@
 {
+  config,
   pkgs,
   ...
 }:

@@ -6,8 +7,14 @@ {
   imports = [
     ../settings/configuration/nur.nix
   ];
+  age.secrets = {
+    # TS_AUTHKEY for caddy-tailscale plugin
+    caddy.file = ../../secrets/caddy.age;
+  };
+
 
   services.caddy = {
+    environmentFile = config.age.secrets.caddy.path;
     package = pkgs.nur.repos.xyenon.caddy.withPlugins {
       plugins = [
         "github.com/caddyserver/cache-handler@v0.16.0"
M system/settings/services/caddy.nix → system/settings/services/caddy.nix
@@ -4,8 +4,6 @@ lib,
   ...
 }:
 {
-  age.secrets.caddy.file = ../../../secrets/caddy.age;
-
   services.tailscale.permitCertUid = config.services.caddy.user;
 
   security.acme.defaults.reloadServices = [ "caddy" ];

@@ -14,7 +12,6 @@
   services.caddy = {
     enable = true;
     group = "caddy";
-    environmentFile = config.age.secrets.caddy.path;
     virtualHosts = {
       "http://" = {
         # Needed for HTTP->HTTPS servers