Lars Nolden
48 lines
1.2 KiB
Nix
48 lines
1.2 KiB
Nix
{ config, lib, pkgs, ... }:
|
|
|
|
let
|
|
cfg = config.services.gebos.caddy;
|
|
|
|
siteBlock = host: site:
|
|
if site ? staticRoot then ''
|
|
${host} {
|
|
root * ${site.staticRoot}
|
|
file_server
|
|
try_files {path} /index.html
|
|
encode zstd gzip
|
|
}
|
|
''
|
|
else if site ? upstream then ''
|
|
${host} {
|
|
reverse_proxy ${site.upstream}
|
|
encode zstd gzip
|
|
}
|
|
''
|
|
else if site ? tcpProxy then ''
|
|
${host}:8883 {
|
|
# TLS termination for MQTT — Caddy's `layer4` app would be ideal here;
|
|
# for now, document that the upstream HiveMQ port is ${site.tcpProxy}.
|
|
# TODO: switch to the caddy-l4 module or terminate TLS in HiveMQ directly.
|
|
}
|
|
''
|
|
else throw "site `${host}` needs one of: staticRoot, upstream, tcpProxy";
|
|
in
|
|
{
|
|
options.services.gebos.caddy = {
|
|
enable = lib.mkEnableOption "Gebos Caddy reverse proxy / TLS terminator";
|
|
sites = lib.mkOption {
|
|
type = lib.types.attrsOf lib.types.attrs;
|
|
default = { };
|
|
};
|
|
};
|
|
|
|
config = lib.mkIf cfg.enable {
|
|
services.caddy = {
|
|
enable = true;
|
|
email = "ops@gebos.online"; # TODO: confirm ACME contact
|
|
extraConfig = lib.concatStringsSep "\n"
|
|
(lib.mapAttrsToList siteBlock cfg.sites);
|
|
};
|
|
};
|
|
}
|