mirror of
https://github.com/SebastianStork/nixos-config.git
synced 2026-01-21 15:11:34 +01:00
caddy: Use wildcard certificate for non tailscale domains
This commit is contained in:
parent
86d0cb60d5
commit
c917eed038
2 changed files with 128 additions and 71 deletions
|
|
@ -26,6 +26,10 @@
|
|||
"outline": {
|
||||
"gitlab-auth-secret": "ENC[AES256_GCM,data:NL3jRp2Np8GQGzndQNxfPTcQBFy+THfxEEoE95UVILlvG0rZ+fbjTdOyZlf40fPWlqwJnXP8uuOJyNE0aJvjbrdeZSJFvQ==,iv:r8beb6gj4qqos57fNRY2LwXW87nZKdCgr49Qf8GReqk=,tag:RxHK8AH+6iMetxlPwt0Xzw==,type:str]"
|
||||
},
|
||||
"porkbun": {
|
||||
"api-key": "ENC[AES256_GCM,data:Du7QvMdZUZmY0onb+OG+/KB8onXvTAaLbDTqPblQjRcPLFySK3F3q181zGLay+JoomgaGI9ijxfBArAhYW/0ZLq+7UM=,iv:jNJusyrQqmmsU2olj7lP7YhYBCKE3Du1Ms79zH9kFa0=,tag:wt+PGAUDxzwHOnI8jdE61Q==,type:str]",
|
||||
"api-secret-key": "ENC[AES256_GCM,data:zb1aNiXPPrbDyiX/bbkTVqyg/bHKaaMxqCJzEC3TYUkZUl4/EsfDQA+mlBDtx9lxxHDurxj1Ocu2H9DN6KnnGrdKrO4=,iv:W5HDePqDqfndfE2Jce8t3W1z97axBSvA2kzu6ichuTE=,tag:d6WxvecyfmqRKVhbGeiZFw==,type:str]"
|
||||
},
|
||||
"sops": {
|
||||
"age": [
|
||||
{
|
||||
|
|
@ -37,8 +41,8 @@
|
|||
"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA4OGcxUHFrNW5PMlZVL0hF\naUtvZzRZTEs0SjRUKythaTB6WUdOODJKODI4ClNuVjVqdGlSMTdGSW9GMCtpbUxn\ncnZvckxkWDBNV3hQQnpnZ0xkeWJ1K0EKLS0tIDBGdTZINTVoeFNMQmpsZVg5S2xv\nbXF5M0FJOCs3b1dqcGF6bXJsd3dyc2sKIpq/yiNubX/yMt/Kj7TYThm3/Kj6we+X\ngvijkVVdddCyO0TH2GZQM5rIQvSq299GwcECDHh7QSUVhEAerJA3qw==\n-----END AGE ENCRYPTED FILE-----\n"
|
||||
}
|
||||
],
|
||||
"lastmodified": "2025-09-20T13:10:49Z",
|
||||
"mac": "ENC[AES256_GCM,data:irwvi21SwFnL1Xn7tnXQ7aGKpGjq3rImD5rhUnYP5x9jcGECoDcwlSWPAkGdnDlAFgZb2RJaqMImrLa+cJKwJt/LQMgqlOzVLbw2kio0Uc6Xo6yPn7uTgGOKvumFgjFCIImDyHr7vJXDtir4jDwTMlIf7/WlwgVtbaFZYdoFl9Y=,iv:D9Mye4CbYlIm1g81VkRA/iOw/DTiXCf70NpxQvrbWTk=,tag:aNjpgdlteShU4YkA+eaAFg==,type:str]",
|
||||
"lastmodified": "2025-09-22T19:09:21Z",
|
||||
"mac": "ENC[AES256_GCM,data:PPlJDjV8nmXsfsqox7lVMIGj7llMALrPrxsivg0xlnoTDY2iao2DDPXw/AQZrCnzzRoUS8C3dFhUnGwFq129vp6WOeX+u70KL6JTHzswiep7eJsJd7e6imoXq1YKvpXL9Dpbss6TQLVlDk3tlubjiVpmcJrqBkbrSEiBHnc+uuE=,iv:naVarWbnfIdlEz0C9D6v0Qq14rgFCMe4kEoTfR1TuRU=,tag:ruepnxD5Y0o/B7fxpvtU2w==,type:str]",
|
||||
"unencrypted_suffix": "_unencrypted",
|
||||
"version": "3.10.2"
|
||||
}
|
||||
|
|
|
|||
|
|
@ -5,39 +5,21 @@
|
|||
...
|
||||
}:
|
||||
let
|
||||
caddyWithTailscale = pkgs.caddy.withPlugins {
|
||||
plugins = [ "github.com/tailscale/caddy-tailscale@v0.0.0-20250508175905-642f61fea3cc" ];
|
||||
hash = "sha256-bw2ZH+XTQlyYw5LgkVr+oEeL8Nf4j/KO2XQIUrsVpiU=";
|
||||
};
|
||||
cfg = config.custom.services.caddy;
|
||||
inherit (config.services.caddy) user;
|
||||
|
||||
virtualHosts =
|
||||
config.custom.services.caddy.virtualHosts |> lib.filterAttrs (_: value: value.enable);
|
||||
virtualHosts = cfg.virtualHosts |> lib.attrValues |> lib.filter (value: value.enable);
|
||||
|
||||
isTailscaleDomain = domain: domain |> lib.hasSuffix config.custom.services.tailscale.domain;
|
||||
|
||||
tailscaleHostsExist =
|
||||
virtualHosts |> lib.attrValues |> lib.any (value: isTailscaleDomain value.domain);
|
||||
nonTailscaleHostsExist =
|
||||
virtualHosts |> lib.attrValues |> lib.any (value: !isTailscaleDomain value.domain);
|
||||
tailscaleHosts = virtualHosts |> lib.filter (value: isTailscaleDomain value.domain);
|
||||
tailscaleHostsExist = tailscaleHosts != [ ];
|
||||
|
||||
nonTailscaleHosts = virtualHosts |> lib.filter (value: !isTailscaleDomain value.domain);
|
||||
nonTailscaleHostsExist = nonTailscaleHosts != [ ];
|
||||
|
||||
getSubdomain = domain: domain |> lib.splitString "." |> lib.head;
|
||||
|
||||
mkVirtualHostConfig =
|
||||
{
|
||||
domain,
|
||||
port,
|
||||
extraReverseProxyConfig,
|
||||
...
|
||||
}:
|
||||
{
|
||||
logFormat = "output file ${config.services.caddy.logDir}/access-${domain}.log { mode 640 }";
|
||||
extraConfig = ''
|
||||
${lib.optionalString (isTailscaleDomain domain) "bind tailscale/${getSubdomain domain}"}
|
||||
reverse_proxy localhost:${builtins.toString port} ${
|
||||
lib.optionalString (extraReverseProxyConfig != "") "{ ${extraReverseProxyConfig} }"
|
||||
}
|
||||
'';
|
||||
};
|
||||
getRootDomain = domain: domain |> lib.splitString "." |> lib.tail |> lib.concatStringsSep ".";
|
||||
|
||||
webPorts = [
|
||||
80
|
||||
|
|
@ -45,76 +27,147 @@ let
|
|||
];
|
||||
in
|
||||
{
|
||||
options.custom.services.caddy.virtualHosts = lib.mkOption {
|
||||
type = lib.types.attrsOf (
|
||||
lib.types.submodule (
|
||||
{ name, ... }:
|
||||
{
|
||||
options = {
|
||||
enable = lib.mkEnableOption "" // {
|
||||
default = true;
|
||||
options.custom.services.caddy = {
|
||||
enable = lib.mkEnableOption "" // {
|
||||
default = virtualHosts != { };
|
||||
};
|
||||
virtualHosts = lib.mkOption {
|
||||
type = lib.types.attrsOf (
|
||||
lib.types.submodule (
|
||||
{ name, ... }:
|
||||
{
|
||||
options = {
|
||||
enable = lib.mkEnableOption "" // {
|
||||
default = true;
|
||||
};
|
||||
domain = lib.mkOption {
|
||||
type = lib.types.nonEmptyStr;
|
||||
default = name;
|
||||
};
|
||||
port = lib.mkOption {
|
||||
type = lib.types.port;
|
||||
default = null;
|
||||
};
|
||||
tls = lib.mkEnableOption "" // {
|
||||
default = true;
|
||||
};
|
||||
extraReverseProxyConfig = lib.mkOption {
|
||||
type = lib.types.lines;
|
||||
default = "";
|
||||
};
|
||||
};
|
||||
domain = lib.mkOption {
|
||||
type = lib.types.nonEmptyStr;
|
||||
default = name;
|
||||
};
|
||||
port = lib.mkOption {
|
||||
type = lib.types.port;
|
||||
default = null;
|
||||
};
|
||||
tls = lib.mkEnableOption "" // {
|
||||
default = true;
|
||||
};
|
||||
extraReverseProxyConfig = lib.mkOption {
|
||||
type = lib.types.lines;
|
||||
default = "";
|
||||
};
|
||||
};
|
||||
}
|
||||
)
|
||||
);
|
||||
default = { };
|
||||
}
|
||||
)
|
||||
);
|
||||
default = { };
|
||||
};
|
||||
};
|
||||
|
||||
config = lib.mkIf (virtualHosts != { }) (
|
||||
lib.mkMerge [
|
||||
{
|
||||
meta.ports.tcp.list = lib.mkIf nonTailscaleHostsExist webPorts;
|
||||
|
||||
networking.firewall.allowedTCPPorts = [ 2019 ] ++ lib.optionals nonTailscaleHostsExist webPorts;
|
||||
|
||||
services.caddy = {
|
||||
enable = true;
|
||||
package = pkgs.caddy.withPlugins {
|
||||
plugins = [
|
||||
"github.com/tailscale/caddy-tailscale@v0.0.0-20250508175905-642f61fea3cc"
|
||||
"github.com/caddy-dns/porkbun@v0.3.1"
|
||||
];
|
||||
hash = "sha256-117vurf98sK/4o3JU3rBwNBUjnZZyFRJ1mq5T1S1IxY=";
|
||||
};
|
||||
globalConfig = ''
|
||||
metrics { per_host }
|
||||
'';
|
||||
virtualHosts =
|
||||
virtualHosts
|
||||
|> lib.mapAttrs' (
|
||||
_: value:
|
||||
lib.nameValuePair ((lib.optionalString (!value.tls) "http://") + value.domain) (
|
||||
mkVirtualHostConfig value
|
||||
)
|
||||
);
|
||||
};
|
||||
|
||||
custom.persist.directories = [ "/var/lib/caddy" ];
|
||||
}
|
||||
|
||||
(lib.mkIf nonTailscaleHostsExist {
|
||||
sops = {
|
||||
secrets."porkbun/api-key" = {
|
||||
owner = user;
|
||||
restartUnits = [ "caddy.service" ];
|
||||
};
|
||||
secrets."porkbun/api-secret-key" = {
|
||||
owner = user;
|
||||
restartUnits = [ "caddy.service" ];
|
||||
};
|
||||
};
|
||||
|
||||
meta.ports.tcp.list = webPorts;
|
||||
networking.firewall.allowedTCPPorts = webPorts;
|
||||
|
||||
services.caddy = {
|
||||
globalConfig = ''
|
||||
acme_dns porkbun {
|
||||
api_key {file.${config.sops.secrets."porkbun/api-key".path}}
|
||||
api_secret_key {file.${config.sops.secrets."porkbun/api-secret-key".path}}
|
||||
}
|
||||
'';
|
||||
extraConfig = ''
|
||||
(subdomain-log) {
|
||||
log {
|
||||
hostnames {args[0]}
|
||||
output file ${config.services.caddy.logDir}/{args[0]}.log { mode 640 }
|
||||
}
|
||||
}
|
||||
'';
|
||||
virtualHosts =
|
||||
let
|
||||
mkWildCardDomain = name: values: {
|
||||
name = "*.${name}";
|
||||
value = {
|
||||
logFormat = "";
|
||||
extraConfig =
|
||||
let
|
||||
mkHostConfig = value: ''
|
||||
import subdomain-log ${value.domain}
|
||||
@${value.domain |> getSubdomain} host ${(lib.optionalString (!value.tls) "http://") + value.domain}
|
||||
handle @${value.domain |> getSubdomain} {
|
||||
reverse_proxy localhost:${builtins.toString value.port} ${
|
||||
lib.optionalString (value.extraReverseProxyConfig != "") "{ ${value.extraReverseProxyConfig} }"
|
||||
}
|
||||
}
|
||||
'';
|
||||
in
|
||||
values |> lib.map (value: mkHostConfig value) |> lib.concatLines;
|
||||
};
|
||||
};
|
||||
in
|
||||
nonTailscaleHosts |> lib.groupBy (x: x.domain |> getRootDomain) |> lib.mapAttrs' mkWildCardDomain;
|
||||
};
|
||||
})
|
||||
|
||||
(lib.mkIf tailscaleHostsExist {
|
||||
sops.secrets."tailscale/service-auth-key" = {
|
||||
owner = config.services.caddy.user;
|
||||
owner = user;
|
||||
restartUnits = [ "caddy.service" ];
|
||||
};
|
||||
|
||||
services.caddy = {
|
||||
package = caddyWithTailscale;
|
||||
globalConfig = ''
|
||||
tailscale {
|
||||
auth_key {file.${config.sops.secrets."tailscale/service-auth-key".path}}
|
||||
ephemeral true
|
||||
}
|
||||
'';
|
||||
virtualHosts =
|
||||
let
|
||||
mkHostConfig = value: {
|
||||
name = (lib.optionalString (!value.tls) "http://") + value.domain;
|
||||
value = {
|
||||
logFormat = "output file ${config.services.caddy.logDir}/${value.domain}.log { mode 640 }";
|
||||
extraConfig = ''
|
||||
bind tailscale/${getSubdomain value.domain}
|
||||
reverse_proxy localhost:${builtins.toString value.port} ${
|
||||
lib.optionalString (value.extraReverseProxyConfig != "") "{ ${value.extraReverseProxyConfig} }"
|
||||
}
|
||||
'';
|
||||
};
|
||||
};
|
||||
in
|
||||
tailscaleHosts |> lib.map (value: mkHostConfig value) |> lib.listToAttrs;
|
||||
};
|
||||
})
|
||||
]
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue