From e5b8d6eb94e4917358b85849c392e859f558ea02 Mon Sep 17 00:00:00 2001
From: blake <me@blakedheld.xyz>
Date: Tue, 28 Jul 2026 09:38:58 -0500
Subject: [PATCH] setup caddy for ssl via dns with cloudflare

---
 modules/homelab/network/caddy/default.nix | 7 ++-----
 1 file changed, 2 insertions(+), 5 deletions(-)

diff --git a/modules/homelab/network/caddy/default.nix b/modules/homelab/network/caddy/default.nix
index dc9feab..c2384ea 100644
--- a/modules/homelab/network/caddy/default.nix
+++ b/modules/homelab/network/caddy/default.nix
@@ -80,11 +80,6 @@ in {
       };
     };
 
-    # make cloudflare token readable
-    systemd.services.caddy.serviceConfig = {
-      EnvironmentFile = sec."cloudflare/api_token_caddy".path;
-    };
-
     # enable acme for auto ssl certs with lets encrypt
     security.acme = {
       acceptTerms = true;
@@ -94,6 +89,8 @@ in {
     # override umask to make permissions work out
     systemd.services.${service}.serviceConfig = {
       UMask = lib.mkForce "0007";
+      # make cloudflare token readable
+      EnvironmentFile = sec."cloudflare/api_token_caddy".path;
     };
 
     # open firewall