129 lines
3.4 KiB
Nix
129 lines
3.4 KiB
Nix
{
|
|
pkgs,
|
|
lib,
|
|
config,
|
|
...
|
|
}: {
|
|
services.caddy = {
|
|
enable = true;
|
|
openFirewall = true;
|
|
environmentFile = "/run/secrets/caddy.env";
|
|
package = pkgs.caddy.withPlugins {
|
|
plugins = ["github.com/caddy-dns/cloudflare@v0.2.4"];
|
|
hash = "sha256-7GoH8YLCoPmPExQxoga2FHB58zQDoZVf1BBwkVi0SsQ=";
|
|
};
|
|
globalConfig = ''
|
|
email {$EMAIL}
|
|
acme_dns cloudflare {$CLOUDFLARE} {
|
|
resolvers 1.1.1.1:53 1.0.0.1:53
|
|
}
|
|
'';
|
|
# Public
|
|
virtualHosts = {
|
|
"nicknase27.com" = {
|
|
extraConfig = ''
|
|
# CORS headers for Matrix .well-known lookup
|
|
@matrix path /.well-known/matrix/*
|
|
header @matrix {
|
|
Access-Control-Allow-Origin "*"
|
|
Access-Control-Allow-Methods "GET, POST, PUT, DELETE, OPTIONS"
|
|
Access-Control-Allow-Headers "X-Requested-With, Content-Type, Authorization"
|
|
Content-Type "application/json"
|
|
}
|
|
|
|
# Matrix Client & Server Delegation
|
|
respond /.well-known/matrix/client `{"m.homeserver":{"base_url":"https://nicknase27.com"},"org.matrix.msc4143.rtc_foci":[{"type":"livekit","livekit_service_url":"https://rtc-jwt.nicknase27.com"}]}`
|
|
respond /.well-known/matrix/server `{"m.server":"nicknase27.com:443"}`
|
|
|
|
# Route Matrix API requests to Tuwunel
|
|
reverse_proxy /_matrix/* localhost:6167
|
|
|
|
# Root domain catch-all (disable tuwunel landing page text)
|
|
respond / " " 200
|
|
'';
|
|
};
|
|
# Reverse proxy for LiveKit JWT Service
|
|
"rtc-jwt.nicknase27.com" = {
|
|
extraConfig = ''
|
|
reverse_proxy localhost:8081
|
|
'';
|
|
};
|
|
|
|
# Reverse proxy for LiveKit WebSocket / Signal API
|
|
"matrix-rtc.nicknase27.com" = {
|
|
extraConfig = ''
|
|
reverse_proxy localhost:7880
|
|
'';
|
|
};
|
|
"nv.nicknase27.com" = {
|
|
extraConfig = ''
|
|
reverse_proxy localhost:4533
|
|
'';
|
|
serverAliases = ["music.nicknase27.com"];
|
|
};
|
|
"vt.nicknase27.com" = {
|
|
extraConfig = ''
|
|
reverse_proxy localhost:8222
|
|
'';
|
|
serverAliases = ["vault.nicknase27.com"];
|
|
};
|
|
"git.nicknase27.com" = {
|
|
extraConfig = ''
|
|
reverse_proxy localhost:3000
|
|
'';
|
|
};
|
|
"jf.nicknase27.com" = {
|
|
extraConfig = ''
|
|
reverse_proxy storage.local:8096
|
|
'';
|
|
serverAliases = ["watch.nicknase27.com"];
|
|
};
|
|
|
|
# Local
|
|
"opn.nicknase27.com" = {
|
|
extraConfig = ''
|
|
reverse_proxy 10.0.0.1:80
|
|
'';
|
|
};
|
|
"ui.nicknase27.com" = {
|
|
extraConfig = ''
|
|
reverse_proxy https://localhost:11443 {
|
|
transport http {
|
|
tls_insecure_skip_verify
|
|
}
|
|
|
|
}
|
|
|
|
'';
|
|
};
|
|
"home.nicknase27.com" = {
|
|
extraConfig = ''
|
|
reverse_proxy localhost:8082
|
|
'';
|
|
};
|
|
"torrent.nicknase27.com" = {
|
|
extraConfig = ''
|
|
reverse_proxy localhost:9091
|
|
'';
|
|
};
|
|
"storage.nicknase27.com" = {
|
|
extraConfig = ''
|
|
reverse_proxy storage.local:80
|
|
'';
|
|
};
|
|
"photos.nicknase27.com" = {
|
|
extraConfig = ''
|
|
reverse_proxy storage.local:2283
|
|
'';
|
|
};
|
|
};
|
|
};
|
|
|
|
age.secrets.caddy = {
|
|
file = ../../secrets/caddy.age;
|
|
path = "/run/secrets/caddy.env";
|
|
owner = "caddy";
|
|
group = "caddy";
|
|
};
|
|
}
|