all repos — nixfiles @ f4d0bebba79cfb9cef3d91d81c15c979f7b236e0

System and user configuration, managed by nix and home-manager

extract custom caddy build to reverse-proxy module when used for host- or network-local access, the external modules are not required. Since the builder module is in NUR, this was causing evaluation failures on systems where NUR was not configured

Alin
commit

f4d0bebba79cfb9cef3d91d81c15c979f7b236e0

parent

cca64cb6ef70301909dba052dc40fa90f376c403

1 file changed, 2 insertions(+), 40 deletions(-)

changed files
M system/settings/services/caddy.nix → system/settings/services/caddy.nix
@@ -1,6 +1,6 @@
 {
   config,
-  pkgs,
+  lib,
   ...
 }:
 {

@@ -15,39 +15,13 @@ services.caddy = {
     enable = true;
     group = "caddy";
     environmentFile = config.age.secrets.caddy.path;
-    package = pkgs.nur.repos.xyenon.caddy.withPlugins {
-      plugins = [
-        "github.com/caddyserver/cache-handler@v0.16.0"
-        "github.com/mholt/caddy-l4@v0.0.0-20260212155620-dd12cc413469"
-        "github.com/tailscale/caddy-tailscale@v0.0.0-20260106222316-bb080c4414ac"
-      ];
-      hash = "sha256-A+wDNJijfD1pnOePXCVMXYzRNxf4Fmpbq2rJG+FMstM=";
-    };
-    globalConfig = ''
-      cache
-      servers {
-        listener_wrappers {
-          layer4 {
-            @ssh ssh
-            route @ssh {
-              proxy localhost:22
-            }
-            route
-          }
-          tls
-        }
-      }
-      tailscale {
-        tags tag:app
-      }
-    '';
     virtualHosts = {
       "http://" = {
         # Needed for HTTP->HTTPS servers
       };
       "${config.networking.fqdn}" = {
         serverAliases = [ "https://" ];
-        extraConfig = ''
+        extraConfig = lib.mkDefault ''
           respond * 204
         '';
       };

@@ -55,17 +29,5 @@ };
   };
   systemd.services.caddy.serviceConfig = {
     UMask = "007";
-  };
-
-  users.groups.webservice = {
-    members = [ "caddy" ];
-  };
-  systemd.tmpfiles.rules = [
-    # setgid bit (2)
-    # sticky bit (4)
-    "d /run/web/ 6770 caddy webservice -"
-  ];
-  systemd.services.caddy.serviceConfig = {
-    ReadWritePaths = [ "/run/web" ];
   };
 }