blake/nix
1
1
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

setup caddy for ssl via dns with cloudflare

Browse Source
This commit is contained in:
blake
2026-07-28 09:36:33 -05:00
parent 79a04d45a4
commit 9659dcf9ef
2 changed files with 21 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
modules/homelab/network/caddy/default.nix
+17
View File
@@ -54,11 +54,24 @@ in {
user = service; user = service;
group = service; group = service;
dataDir = cfg.data_dir; dataDir = cfg.data_dir;
package = pkgs.caddy.withPlugins {
plugins = [
"github.com/caddy-dns/cloudflare"
];
hash = "sha256-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=";
# Replace with the hash from the build error the first time you build.
};
email = "me@blakedheld.xyz"; email = "me@blakedheld.xyz";
globalConfig = '' globalConfig = ''
auto_https ignore_loaded_certs auto_https ignore_loaded_certs
acme_dns cloudflare {env.CLOUDFLARE_API_TOKEN}
''; '';
# make cloudflare token readable
systemd.services.caddy.serviceConfig = {
EnvironmentFile = sec."cloudflare/api_token_caddy".path;
};
# static page for hosting key files # static page for hosting key files
virtualHosts = { virtualHosts = {
"keys.${homelab.base_domain}" = lib.mkIf cfg.keys { "keys.${homelab.base_domain}" = lib.mkIf cfg.keys {
@@ -97,6 +110,10 @@ in {
group = "caddy"; group = "caddy";
path = "/etc/ssl/blakedheld.xyz.key"; path = "/etc/ssl/blakedheld.xyz.key";
}; };
"cloudflare/api_token_caddy" = {
owner = "caddy";
group = "caddy";
};
"klefki_pub.asc" = { "klefki_pub.asc" = {
owner = "caddy"; owner = "caddy";
group = "caddy"; group = "caddy";
secrets/secrets.yaml
+4 -3
View File
@@ -11,6 +11,7 @@ lifeboat_rsync: ENC[AES256_GCM,data:OaijbFFpu8RM3gcWu2XbAHeuUhTIjFNO8aYcA8TJmNxM
#ENC[AES256_GCM,data:NbXyRroLF2uxHjROnBg9OLQ=,iv:W9Nse9yamov3rflDKBeISO+miQkjH7QfBUZdsDmDM4I=,tag:/RmH3JyriXFxf0hEh9/iRQ==,type:comment] #ENC[AES256_GCM,data:NbXyRroLF2uxHjROnBg9OLQ=,iv:W9Nse9yamov3rflDKBeISO+miQkjH7QfBUZdsDmDM4I=,tag:/RmH3JyriXFxf0hEh9/iRQ==,type:comment]
cloudflare: cloudflare:
api_token: ENC[AES256_GCM,data:VuRwfZe1cdnQLvxlp9GCDOt9Ijhz4fh2yOev2wLOdLV+zw91blA3Zis2BRyI/ZwN4y+IhiqlpBzXCsoFqw==,iv:6Bt11zz1/slvszh9ZGQ0ov5ts0jAZIAMx3G2AimKIs4=,tag:tyEVhsKCGrJWm6yn+GUlUQ==,type:str] api_token: ENC[AES256_GCM,data:VuRwfZe1cdnQLvxlp9GCDOt9Ijhz4fh2yOev2wLOdLV+zw91blA3Zis2BRyI/ZwN4y+IhiqlpBzXCsoFqw==,iv:6Bt11zz1/slvszh9ZGQ0ov5ts0jAZIAMx3G2AimKIs4=,tag:tyEVhsKCGrJWm6yn+GUlUQ==,type:str]
api_token_caddy: ENC[AES256_GCM,data:L1PMeI4zOCPbWuWrczM1aSYl/qk/MW8xLtxr/PL+a3zfDA+USP8Yw4liYnn1qwTxs+oLMHhpBR58kHPr8Q==,iv:NNVBPANwQ9koAKTQD4ikhtwFjCpMLMXEm9scj9jIDFo=,tag:SXt1Y+04BuSsjDhu5ykwLA==,type:str]
#ENC[AES256_GCM,data:3Nnp9ASh+BPPwSOa+Xx3YEqKnh48oW6sWCQCXy9iZ61qGv9Ubjeaccr+Bh0bD9s=,iv:LwbptKdbhO2yki2BIK+6uPMqe14FNC4EcIwO6HS5xAc=,tag:38P0kwfAFVEps6MnMU8XeA==,type:comment] #ENC[AES256_GCM,data:3Nnp9ASh+BPPwSOa+Xx3YEqKnh48oW6sWCQCXy9iZ61qGv9Ubjeaccr+Bh0bD9s=,iv:LwbptKdbhO2yki2BIK+6uPMqe14FNC4EcIwO6HS5xAc=,tag:38P0kwfAFVEps6MnMU8XeA==,type:comment]
email_pass: ENC[AES256_GCM,data:T4heTFuvD3rUJUInDpJnIhwECw==,iv:uDOk6FKtfYjedE/I3zh9Tl7QuYz/OBe/3tlrTitf2DY=,tag:a80RoPPHMSETAbk5pqGfiQ==,type:str] email_pass: ENC[AES256_GCM,data:T4heTFuvD3rUJUInDpJnIhwECw==,iv:uDOk6FKtfYjedE/I3zh9Tl7QuYz/OBe/3tlrTitf2DY=,tag:a80RoPPHMSETAbk5pqGfiQ==,type:str]
#ENC[AES256_GCM,data:ztRwuY0mTMDmwV5HqVR7Dmc+dCWcrVRtWZGEL1abE/WUcA==,iv:mmaWfHRiENJUGNhyUBFo1z7PdzVPH1OUZrVhkce6KV0=,tag:GKEvT0qkzTtimQXDueKPdw==,type:comment] #ENC[AES256_GCM,data:ztRwuY0mTMDmwV5HqVR7Dmc+dCWcrVRtWZGEL1abE/WUcA==,iv:mmaWfHRiENJUGNhyUBFo1z7PdzVPH1OUZrVhkce6KV0=,tag:GKEvT0qkzTtimQXDueKPdw==,type:comment]
@@ -83,7 +84,7 @@ sops:
PRu+itNolpPTHm96pe+P93g2iP0wgekG0cX21wkiU2xaLF3dY2FEIA== PRu+itNolpPTHm96pe+P93g2iP0wgekG0cX21wkiU2xaLF3dY2FEIA==
-----END AGE ENCRYPTED FILE----- -----END AGE ENCRYPTED FILE-----
recipient: age14gfh682a7m7jfp3qrulql03x5rs7yedwmxwksxrrmgjsunstyuksqx93pz recipient: age14gfh682a7m7jfp3qrulql03x5rs7yedwmxwksxrrmgjsunstyuksqx93pz
lastmodified: "2026-06-22T20:37:37Z" lastmodified: "2026-07-28T14:33:14Z"
mac: ENC[AES256_GCM,data:UQOsQF+ixV+B9dWFySz8osRV24clDTvyI4niCnwU2LWVMlW6XSTkAyKxyLHoEl9aCOgJ4hCEuNXu7IWBWY2a4padtILs4I//K6+JhWb/++53JMjtZ8K+QzdvhcPL1632ANnXZlJLzW/h6nLD2Zoa9hemaTD9ybffXBDF1sVGij4=,iv:R7cr3V3KS63F8XYgbGKvFZhC4558LN4dnGqDn0zM/bo=,tag:mRTvPIiyRHTV36RymZ2ZZQ==,type:str] mac: ENC[AES256_GCM,data:bEcpoMFzXbK4WCs94Y4I5CDo9JDC4/6iRMfgc41m1o8/qJhKyJUWWZcPhJSaRSituTYyPjSe8aB6k2Vwpgcd+hk41JC2Op09mnjBWfDQz6Ts0YbZAnZ/dV4IrzdxYRtM91EXmJnROeiTftGgYN/6Awa8I+ie3UFBl8u6/5UoD7o=,iv:MIhnNS9RGFWKJ0LI7Ae9gTEcGzfKwQB4bg4oSAs8/Go=,tag:W/zfVpxn+sRa+FOrR9fKyA==,type:str]
unencrypted_suffix: _unencrypted unencrypted_suffix: _unencrypted
version: 3.13.1 version: 3.13.2