setup caddy for ssl via dns with cloudflare

modules/homelab/network/caddy/default.nix

@@ -54,11 +54,24 @@ in {
       user = service;
       group = service;
       dataDir = cfg.data_dir;
+      package = pkgs.caddy.withPlugins {
+        plugins = [
+          "github.com/caddy-dns/cloudflare"
+        ];
+        hash = "sha256-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=";
+        # Replace with the hash from the build error the first time you build.
+      };
       email = "me@blakedheld.xyz";
       globalConfig = ''
         auto_https ignore_loaded_certs
+        acme_dns cloudflare {env.CLOUDFLARE_API_TOKEN}
       '';
 
+      # make cloudflare token readable
+      systemd.services.caddy.serviceConfig = {
+        EnvironmentFile = sec."cloudflare/api_token_caddy".path;
+      };
+
       # static page for hosting key files
       virtualHosts = {
         "keys.${homelab.base_domain}" = lib.mkIf cfg.keys {
@@ -97,6 +110,10 @@ in {
         group = "caddy";
         path = "/etc/ssl/blakedheld.xyz.key";
       };
+      "cloudflare/api_token_caddy" = {
+        owner = "caddy";
+        group = "caddy";
+      };
       "klefki_pub.asc" = {
         owner = "caddy";
         group = "caddy";