SebastianStork/nixos-config
1
0
Fork 0
mirror of https://github.com/SebastianStork/nixos-config.git synced 2026-01-21 12:51:34 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

caddy: Add support for web services over nebula

Browse source
This commit is contained in:
SebastianStork 2026-01-10 23:19:49 +01:00
parent b7db8d2fd8
commit 116b4437fe
Signed by: SebastianStork
SSH key fingerprint: SHA256:tRrGdjYOwgHxpSc/wTOZQZEjxcb15P0tyXRsbAfd+2Q
3 changed files with 84 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

3
lib/default.nix
View file

@ -5,6 +5,9 @@
{
isTailscaleDomain = domain: domain |> lib.hasSuffix ".ts.net";
isPrivateDomain =
domain: domain |> lib.hasSuffix ".splitleaf.de";
subdomainOf = domain: domain |> lib.splitString "." |> lib.head;
rootDomainOf = domain: domain |> lib.splitString "." |> lib.tail |> lib.concatStringsSep ".";

60
modules/system/services/caddy.nix
View file

@ -11,8 +11,11 @@ let
virtualHosts = cfg.virtualHosts |> lib.attrValues |> lib.filter (value: value.enable);
publicHostsExist = virtualHosts |> lib.any (value: !lib'.isTailscaleDomain value.domain);
publicHostsExist =
virtualHosts
|> lib.any (value: (!lib'.isPrivateDomain value.domain) && (!lib'.isTailscaleDomain value.domain));
tailscaleHostsExist = virtualHosts |> lib.any (value: lib'.isTailscaleDomain value.domain);
privateHostsExist = virtualHosts |> lib.any (value: lib'.isPrivateDomain value.domain);
webPorts = [
80
@ -30,6 +33,15 @@ let
logFormat = "output file ${config.services.caddy.logDir}/${domain}.log { mode 640 }";
extraConfig = lib.concatLines [
(lib.optionalString (lib'.isTailscaleDomain domain) "bind tailscale/${lib'.subdomainOf domain}")
(lib.optionalString (lib'.isPrivateDomain domain) (
let
certDir = config.security.acme.certs.${domain}.directory;
in
''
tls ${certDir}/fullchain.pem ${certDir}/key.pem
bind ${config.custom.services.nebula.node.address}
''
))
(lib.optionalString (port != null) "reverse_proxy localhost:${toString port}")
(lib.optionalString (files != null) ''
root * ${files}
@ -122,6 +134,52 @@ in
'';
};
})
(lib.mkIf privateHostsExist {
sops.secrets = {
"porkbun/api-key".owner = config.users.users.acme.name;
"porkbun/secret-api-key".owner = config.users.users.acme.name;
};
security.acme = {
acceptTerms = true;
defaults = {
email = "acme@sstork.dev";
dnsProvider = "porkbun";
dnsResolver = "1.1.1.1:53";
group = config.users.users.caddy.name;
credentialFiles = {
PORKBUN_API_KEY_FILE = config.sops.secrets."porkbun/api-key".path;
PORKBUN_SECRET_API_KEY_FILE = config.sops.secrets."porkbun/secret-api-key".path;
};
reloadServices = [ "caddy.service" ];
};
certs =
virtualHosts
|> lib.filter (host: lib'.isPrivateDomain host.domain)
|> lib.map (host: lib.nameValuePair host.domain { })
|> lib.listToAttrs;
};
services.nebula.networks.mesh.firewall.inbound = [
{
port = "80";
proto = "tcp";
host = "any";
}
{
port = "443";
proto = "tcp";
host = "any";
}
];
systemd.services.caddy = {
requires = [ "nebula@mesh.service" ];
after = [ "nebula@mesh.service" ];
};
})
]
);
}

25
modules/system/services/nebula/dns.nix
View file

@ -1,4 +1,10 @@
{ config, lib, ... }:
{
config,
self,
lib,
lib',
...
}:
let
nebulaCfg = config.custom.services.nebula;
cfg = nebulaCfg.node;
@ -25,8 +31,21 @@ in
local-zone = "\"${nebulaCfg.network.domain}.\" static";
local-data =
nebulaCfg.nodes
|> lib.map (node: "\"${node.name}.${nebulaCfg.network.domain}. A ${node.address}\"");
let
nodeRecords =
nebulaCfg.nodes
|> lib.map (node: "\"${node.name}.${nebulaCfg.network.domain}. A ${node.address}\"");
serviceRecords =
self.nixosConfigurations
|> lib.attrValues
|> lib.concatMap (
host:
host.config.meta.domains.local
|> lib.filter (domain: lib'.isPrivateDomain domain)
|> lib.map (domain: "\"${domain}. A ${host.config.custom.services.nebula.node.address}\"")
);
in
nodeRecords ++ serviceRecords;
};
forward-zone =