extract custom caddy build to reverse-proxy module when used for host- or network-local access, the external modules are not required. Since the builder module is in NUR, this was causing evaluation failures on systems where NUR was not configured
6 files changed, 62 insertions(+), 43 deletions(-)
M flake.nix → flake.nix
@@ -135,11 +135,10 @@ ]; }; nixosConfigurations.linde = nixpkgs.lib.nixosSystem { system = "aarch64-linux"; - specialArgs = { inherit searchix; }; + specialArgs = { inherit inputs; }; modules = [ { nixpkgs.overlays = [ - nur.overlays.default elgit.overlays.default searchix.overlays.default ];@@ -159,10 +158,10 @@ ]; }; nixosConfigurations.smrk = nixpkgs.lib.nixosSystem { system = "x86_64-linux"; + specialArgs = { inherit inputs; }; modules = [ { nixpkgs.overlays = [ - nur.overlays.default elgit.overlays.default searchix.overlays.default ];
M system/hosts/linde.nix → system/hosts/linde.nix
@@ -31,6 +31,7 @@ # Include the results of the hardware scan. ./linde-hardware.nix ../roles/server.nix + ../roles/reverse-proxy.nix ../settings/services/git-server.nix ]; age.secrets = {
M system/hosts/smrk.nix → system/hosts/smrk.nix
@@ -11,6 +11,7 @@ in { imports = [ ../roles/server.nix + ../roles/reverse-proxy.nix ]; system.stateVersion = "25.11";
A system/roles/reverse-proxy.nix
@@ -0,0 +1,50 @@ +{ + pkgs, + ... +}: +{ + imports = [ + ../settings/configuration/nur.nix + ]; + + services.caddy = { + package = pkgs.nur.repos.xyenon.caddy.withPlugins { + plugins = [ + "github.com/caddyserver/cache-handler@v0.16.0" + "github.com/mholt/caddy-l4@v0.0.0-20260212155620-dd12cc413469" + "github.com/tailscale/caddy-tailscale@v0.0.0-20260106222316-bb080c4414ac" + ]; + hash = "sha256-A+wDNJijfD1pnOePXCVMXYzRNxf4Fmpbq2rJG+FMstM="; + }; + globalConfig = '' + cache + servers { + listener_wrappers { + layer4 { + @ssh ssh + route @ssh { + proxy localhost:22 + } + route + } + tls + } + } + tailscale { + tags tag:app + } + ''; + }; + + users.groups.webservice = { + members = [ "caddy" ]; + }; + systemd.tmpfiles.rules = [ + # setgid bit (2) + # sticky bit (4) + "d /run/web/ 6770 caddy webservice -" + ]; + systemd.services.caddy.serviceConfig = { + ReadWritePaths = [ "/run/web" ]; + }; +}
A system/settings/configuration/nur.nix
@@ -0,0 +1,6 @@ +{ inputs, ... }: +{ + nixpkgs.overlays = [ + inputs.nur.overlays.default + ]; +}
M system/settings/services/caddy.nix → system/settings/services/caddy.nix
@@ -1,6 +1,6 @@ { config, - pkgs, + lib, ... }: {@@ -15,39 +15,13 @@ services.caddy = { enable = true; group = "caddy"; environmentFile = config.age.secrets.caddy.path; - package = pkgs.nur.repos.xyenon.caddy.withPlugins { - plugins = [ - "github.com/caddyserver/cache-handler@v0.16.0" - "github.com/mholt/caddy-l4@v0.0.0-20260212155620-dd12cc413469" - "github.com/tailscale/caddy-tailscale@v0.0.0-20260106222316-bb080c4414ac" - ]; - hash = "sha256-A+wDNJijfD1pnOePXCVMXYzRNxf4Fmpbq2rJG+FMstM="; - }; - globalConfig = '' - cache - servers { - listener_wrappers { - layer4 { - @ssh ssh - route @ssh { - proxy localhost:22 - } - route - } - tls - } - } - tailscale { - tags tag:app - } - ''; virtualHosts = { "http://" = { # Needed for HTTP->HTTPS servers }; "${config.networking.fqdn}" = { serverAliases = [ "https://" ]; - extraConfig = '' + extraConfig = lib.mkDefault '' respond * 204 ''; };@@ -55,17 +29,5 @@ }; }; systemd.services.caddy.serviceConfig = { UMask = "007"; - }; - - users.groups.webservice = { - members = [ "caddy" ]; - }; - systemd.tmpfiles.rules = [ - # setgid bit (2) - # sticky bit (4) - "d /run/web/ 6770 caddy webservice -" - ]; - systemd.services.caddy.serviceConfig = { - ReadWritePaths = [ "/run/web" ]; }; }