caddy: Use wildcard certificate for non tailscale domains

hosts/srv-public/secrets.json

@@ -26,6 +26,10 @@
   "outline": {
     "gitlab-auth-secret": "ENC[AES256_GCM,data:NL3jRp2Np8GQGzndQNxfPTcQBFy+THfxEEoE95UVILlvG0rZ+fbjTdOyZlf40fPWlqwJnXP8uuOJyNE0aJvjbrdeZSJFvQ==,iv:r8beb6gj4qqos57fNRY2LwXW87nZKdCgr49Qf8GReqk=,tag:RxHK8AH+6iMetxlPwt0Xzw==,type:str]"
   },
+  "porkbun": {
+    "api-key": "ENC[AES256_GCM,data:Du7QvMdZUZmY0onb+OG+/KB8onXvTAaLbDTqPblQjRcPLFySK3F3q181zGLay+JoomgaGI9ijxfBArAhYW/0ZLq+7UM=,iv:jNJusyrQqmmsU2olj7lP7YhYBCKE3Du1Ms79zH9kFa0=,tag:wt+PGAUDxzwHOnI8jdE61Q==,type:str]",
+    "api-secret-key": "ENC[AES256_GCM,data:zb1aNiXPPrbDyiX/bbkTVqyg/bHKaaMxqCJzEC3TYUkZUl4/EsfDQA+mlBDtx9lxxHDurxj1Ocu2H9DN6KnnGrdKrO4=,iv:W5HDePqDqfndfE2Jce8t3W1z97axBSvA2kzu6ichuTE=,tag:d6WxvecyfmqRKVhbGeiZFw==,type:str]"
+  },
   "sops": {
     "age": [
       {
@@ -37,8 +41,8 @@
         "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA4OGcxUHFrNW5PMlZVL0hF\naUtvZzRZTEs0SjRUKythaTB6WUdOODJKODI4ClNuVjVqdGlSMTdGSW9GMCtpbUxn\ncnZvckxkWDBNV3hQQnpnZ0xkeWJ1K0EKLS0tIDBGdTZINTVoeFNMQmpsZVg5S2xv\nbXF5M0FJOCs3b1dqcGF6bXJsd3dyc2sKIpq/yiNubX/yMt/Kj7TYThm3/Kj6we+X\ngvijkVVdddCyO0TH2GZQM5rIQvSq299GwcECDHh7QSUVhEAerJA3qw==\n-----END AGE ENCRYPTED FILE-----\n"
       }
     ],
-    "lastmodified": "2025-09-20T13:10:49Z",
+    "lastmodified": "2025-09-22T19:09:21Z",
-    "mac": "ENC[AES256_GCM,data:irwvi21SwFnL1Xn7tnXQ7aGKpGjq3rImD5rhUnYP5x9jcGECoDcwlSWPAkGdnDlAFgZb2RJaqMImrLa+cJKwJt/LQMgqlOzVLbw2kio0Uc6Xo6yPn7uTgGOKvumFgjFCIImDyHr7vJXDtir4jDwTMlIf7/WlwgVtbaFZYdoFl9Y=,iv:D9Mye4CbYlIm1g81VkRA/iOw/DTiXCf70NpxQvrbWTk=,tag:aNjpgdlteShU4YkA+eaAFg==,type:str]",
+    "mac": "ENC[AES256_GCM,data:PPlJDjV8nmXsfsqox7lVMIGj7llMALrPrxsivg0xlnoTDY2iao2DDPXw/AQZrCnzzRoUS8C3dFhUnGwFq129vp6WOeX+u70KL6JTHzswiep7eJsJd7e6imoXq1YKvpXL9Dpbss6TQLVlDk3tlubjiVpmcJrqBkbrSEiBHnc+uuE=,iv:naVarWbnfIdlEz0C9D6v0Qq14rgFCMe4kEoTfR1TuRU=,tag:ruepnxD5Y0o/B7fxpvtU2w==,type:str]",
     "unencrypted_suffix": "_unencrypted",
     "version": "3.10.2"
   }

modules/system/services/caddy.nix

@@ -5,39 +5,21 @@
   ...
 }:
 let
-  caddyWithTailscale = pkgs.caddy.withPlugins {
+  cfg = config.custom.services.caddy;
-    plugins = [ "github.com/tailscale/caddy-tailscale@v0.0.0-20250508175905-642f61fea3cc" ];
+  inherit (config.services.caddy) user;
-    hash = "sha256-bw2ZH+XTQlyYw5LgkVr+oEeL8Nf4j/KO2XQIUrsVpiU=";
-  };
 
-  virtualHosts =
+  virtualHosts = cfg.virtualHosts |> lib.attrValues |> lib.filter (value: value.enable);
-    config.custom.services.caddy.virtualHosts |> lib.filterAttrs (_: value: value.enable);
 
   isTailscaleDomain = domain: domain |> lib.hasSuffix config.custom.services.tailscale.domain;
 
-  tailscaleHostsExist =
+  tailscaleHosts = virtualHosts |> lib.filter (value: isTailscaleDomain value.domain);
-    virtualHosts |> lib.attrValues |> lib.any (value: isTailscaleDomain value.domain);
+  tailscaleHostsExist = tailscaleHosts != [ ];
-  nonTailscaleHostsExist =
+
-    virtualHosts |> lib.attrValues |> lib.any (value: !isTailscaleDomain value.domain);
+  nonTailscaleHosts = virtualHosts |> lib.filter (value: !isTailscaleDomain value.domain);
+  nonTailscaleHostsExist = nonTailscaleHosts != [ ];
 
   getSubdomain = domain: domain |> lib.splitString "." |> lib.head;
-
+  getRootDomain = domain: domain |> lib.splitString "." |> lib.tail |> lib.concatStringsSep ".";
-  mkVirtualHostConfig =
-    {
-      domain,
-      port,
-      extraReverseProxyConfig,
-      ...
-    }:
-    {
-      logFormat = "output file ${config.services.caddy.logDir}/access-${domain}.log { mode 640 }";
-      extraConfig = ''
-        ${lib.optionalString (isTailscaleDomain domain) "bind tailscale/${getSubdomain domain}"}
-        reverse_proxy localhost:${builtins.toString port} ${
-          lib.optionalString (extraReverseProxyConfig != "") "{ ${extraReverseProxyConfig} }"
-        }
-      '';
-    };
 
   webPorts = [
     80
@@ -45,7 +27,11 @@ let
   ];
 in
 {
-  options.custom.services.caddy.virtualHosts = lib.mkOption {
+  options.custom.services.caddy = {
+    enable = lib.mkEnableOption "" // {
+      default = virtualHosts != { };
+    };
+    virtualHosts = lib.mkOption {
       type = lib.types.attrsOf (
         lib.types.submodule (
           { name, ... }:
@@ -75,46 +61,113 @@ in
       );
       default = { };
     };
+  };
 
   config = lib.mkIf (virtualHosts != { }) (
     lib.mkMerge [
       {
-        meta.ports.tcp.list = lib.mkIf nonTailscaleHostsExist webPorts;
-
-        networking.firewall.allowedTCPPorts = [ 2019 ] ++ lib.optionals nonTailscaleHostsExist webPorts;
-
         services.caddy = {
           enable = true;
+          package = pkgs.caddy.withPlugins {
+            plugins = [
+              "github.com/tailscale/caddy-tailscale@v0.0.0-20250508175905-642f61fea3cc"
+              "github.com/caddy-dns/porkbun@v0.3.1"
+            ];
+            hash = "sha256-117vurf98sK/4o3JU3rBwNBUjnZZyFRJ1mq5T1S1IxY=";
+          };
           globalConfig = ''
             metrics { per_host }
           '';
-          virtualHosts =
-            virtualHosts
-            |> lib.mapAttrs' (
-              _: value:
-              lib.nameValuePair ((lib.optionalString (!value.tls) "http://") + value.domain) (
-                mkVirtualHostConfig value
-              )
-            );
         };
 
         custom.persist.directories = [ "/var/lib/caddy" ];
       }
 
+      (lib.mkIf nonTailscaleHostsExist {
+        sops = {
+          secrets."porkbun/api-key" = {
+            owner = user;
+            restartUnits = [ "caddy.service" ];
+          };
+          secrets."porkbun/api-secret-key" = {
+            owner = user;
+            restartUnits = [ "caddy.service" ];
+          };
+        };
+
+        meta.ports.tcp.list = webPorts;
+        networking.firewall.allowedTCPPorts = webPorts;
+
+        services.caddy = {
+          globalConfig = ''
+            acme_dns porkbun {
+              api_key {file.${config.sops.secrets."porkbun/api-key".path}}
+              api_secret_key {file.${config.sops.secrets."porkbun/api-secret-key".path}}
+            }
+          '';
+          extraConfig = ''
+            (subdomain-log) {
+              log {
+                hostnames {args[0]}
+                output file ${config.services.caddy.logDir}/{args[0]}.log { mode 640 }
+              }
+            }
+          '';
+          virtualHosts =
+            let
+              mkWildCardDomain = name: values: {
+                name = "*.${name}";
+                value = {
+                  logFormat = "";
+                  extraConfig =
+                    let
+                      mkHostConfig = value: ''
+                        import subdomain-log ${value.domain}
+                        @${value.domain |> getSubdomain} host ${(lib.optionalString (!value.tls) "http://") + value.domain}
+                        handle @${value.domain |> getSubdomain} {
+                          reverse_proxy localhost:${builtins.toString value.port} ${
+                            lib.optionalString (value.extraReverseProxyConfig != "") "{ ${value.extraReverseProxyConfig} }"
+                          }
+                        }
+                      '';
+                    in
+                    values |> lib.map (value: mkHostConfig value) |> lib.concatLines;
+                };
+              };
+            in
+            nonTailscaleHosts |> lib.groupBy (x: x.domain |> getRootDomain) |> lib.mapAttrs' mkWildCardDomain;
+        };
+      })
+
       (lib.mkIf tailscaleHostsExist {
         sops.secrets."tailscale/service-auth-key" = {
-          owner = config.services.caddy.user;
+          owner = user;
           restartUnits = [ "caddy.service" ];
         };
 
         services.caddy = {
-          package = caddyWithTailscale;
           globalConfig = ''
             tailscale {
               auth_key {file.${config.sops.secrets."tailscale/service-auth-key".path}}
               ephemeral true
             }
           '';
+          virtualHosts =
+            let
+              mkHostConfig = value: {
+                name = (lib.optionalString (!value.tls) "http://") + value.domain;
+                value = {
+                  logFormat = "output file ${config.services.caddy.logDir}/${value.domain}.log { mode 640 }";
+                  extraConfig = ''
+                    bind tailscale/${getSubdomain value.domain}
+                    reverse_proxy localhost:${builtins.toString value.port} ${
+                      lib.optionalString (value.extraReverseProxyConfig != "") "{ ${value.extraReverseProxyConfig} }"
+                    }
+                  '';
+                };
+              };
+            in
+            tailscaleHosts |> lib.map (value: mkHostConfig value) |> lib.listToAttrs;
         };
       })
     ]