reverse proxying from vaniville

hosts/nixos/vaniville/configuration.nix

@@ -5,6 +5,7 @@ let
   unstable = unstable_pkgs.x86_64;
   vpsip4 = "100.100.1.10";
   homelabipv4 = "10.10.0.10";
+  homelab = config.homelab;
 in
 {
   imports =
@@ -33,7 +34,8 @@ in
       url = "up.blakedheld.xyz";
     };
     caddy = {
-      enable = false;
+      enable = true;
+      keys = false;
     };
   };
 
@@ -99,21 +101,24 @@ in
       # tailscale will also need its UDP port open:
       allowedUDPPorts = [ config.services.tailscale.port 25777 21116 ];
       trustedInterfaces = [ "tailscale0" ];
+/*
+        iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 80 -j DNAT --to-destination ${homelabipv4}:80        # http
+        iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 443 -j DNAT --to-destination ${homelabipv4}:443      # https
+
+        iptables -t nat -A POSTROUTING -o tailscale0 -p tcp --dport 80 -d ${homelabipv4}/32 -j SNAT --to-source ${vpsip4}     # http
+        iptables -t nat -A POSTROUTING -o tailscale0 -p tcp --dport 443 -d ${homelabipv4}/32 -j SNAT --to-source ${vpsip4}    # https
+*/
       extraCommands = ''
         # Clear any previous rules if you are iterating
         iptables -t nat -F
     
         # DNAT: internet -> homelab over tailscale
-        iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 80 -j DNAT --to-destination ${homelabipv4}:80        # http
-        iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 443 -j DNAT --to-destination ${homelabipv4}:443      # https
         iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 7567 -j DNAT --to-destination ${homelabipv4}:7567    # gitea ssh
         iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 25777 -j DNAT --to-destination ${homelabipv4}:25777  # recpro mc
         iptables -t nat -A PREROUTING -i eth0 -p udp --dport 25777 -j DNAT --to-destination ${homelabipv4}:25777  # recpro mc
         iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 25778 -j DNAT --to-destination ${homelabipv4}:25778  # cbblemon mc
     
         # SNAT: ensure replies go back through VPS tailscale IP
-        iptables -t nat -A POSTROUTING -o tailscale0 -p tcp --dport 80 -d ${homelabipv4}/32 -j SNAT --to-source ${vpsip4}     # http
-        iptables -t nat -A POSTROUTING -o tailscale0 -p tcp --dport 443 -d ${homelabipv4}/32 -j SNAT --to-source ${vpsip4}    # https
         iptables -t nat -A POSTROUTING -o tailscale0 -p tcp --dport 7567 -d ${homelabipv4}/32 -j SNAT --to-source ${vpsip4}   # gitea ssh
         iptables -t nat -A POSTROUTING -o tailscale0 -p tcp --dport 25777 -d ${homelabipv4}/32 -j SNAT --to-source ${vpsip4}  # recpro mc
         iptables -t nat -A POSTROUTING -o tailscale0 -p udp --dport 25777 -d ${homelabipv4}/32 -j SNAT --to-source ${vpsip4}  # recpro mc
@@ -131,6 +136,37 @@ in
     ];
   };
 
+  # forwarding for caddy
+  services.caddy = {
+    virtualHosts = {
+      # for central uptime monitoring
+      "up.${homelab.public_domain}".extraConfig = ''
+        reverse_proxy 127.0.0.1:7901
+      '';
+      # below is basically just manually reverse proxying everything in the homelab
+      # this is instead of forwarding all 80 & 443 traffic to have more explicit 
+      # publishing things to the open web
+      "media.${homelab.public_domain}".extraConfig = ''
+        reverse_proxy 10.10.0.10:7100
+      '';
+      "pass.${homelab.public_domain}".extraConfig = ''
+        reverse_proxy 10.10.0.10:7701
+      '';
+      "photos.${homelab.public_domain}".extraConfig = ''
+        reverse_proxy 10.10.0.10:7702
+      '';
+      "git.${homelab.public_domain}".extraConfig = ''
+        reverse_proxy 10.10.0.10:7703
+      '';
+    };
+  };
+
+  system.stateVersion = "25.05"; # Did you read the comment?
+
+}
+
+    };
+  };
 
   system.stateVersion = "25.05"; # Did you read the comment?
 

modules/homelab/caddy/default.nix

@@ -16,6 +16,11 @@ in
       default = "/var/lib/${service}";
       description = "set data directory for ${service}";
     };
+    keys = lib.mkOption {
+      type = lib.types.bool;
+      default = true;
+      description = "host keys directory";
+    };
     backup = lib.mkOption {
       type = lib.types.bool;
       default = true;
@@ -53,7 +58,7 @@ in
         auto_https ignore_loaded_certs
       '';
       
-      virtualHosts."keys.${homelab.base_domain}" = {
+      virtualHosts."keys.${homelab.base_domain}" =  lib.mkIf cfg.keys {
         serverAliases = [ "keys.${homelab.public_domain}" ];
         extraConfig = ''
             tls internal