Kieran's opinionated (and probably slightly dumb) nix config

feat: add caddy and uptime kuma on prattle

dunkirk.sh dce1beb8 71651f66

verified
Changed files
+39 -1
machines
prattle
secrets
+36 -1
machines/prattle/default.nix
···
path = "/home/kierank/.wakatime.cfg";
owner = "kierank";
};
+
cloudflare = {
+
file = ../../secrets/cloudflare.age;
+
owner = "caddy";
+
};
};
environment.sessionVariables = {
···
networking.firewall = {
enable = true;
-
allowedTCPPorts = [ 22 ];
+
allowedTCPPorts = [ 22 80 443 ];
logRefusedConnections = false;
rejectPackets = true;
};
···
services.tailscale = {
enable = true;
useRoutingFeatures = "client";
+
};
+
+
services.caddy = {
+
enable = true;
+
package = pkgs.caddy.withPlugins {
+
plugins = [ "github.com/caddy-dns/cloudflare@v0.2.2" ];
+
hash = "sha256-Z8nPh4OI3/R1nn667ZC5VgE+Q9vDenaQ3QPKxmqPNkc=";
+
};
+
email = "me@dunkirk.sh";
+
globalConfig = ''
+
acme_dns cloudflare {env.CLOUDFLARE_API_TOKEN}
+
'';
+
virtualHosts."status.dunkirk.sh" = {
+
extraConfig = ''
+
tls {
+
dns cloudflare {env.CLOUDFLARE_API_TOKEN}
+
}
+
reverse_proxy localhost:3001
+
'';
+
};
+
};
+
+
systemd.services.caddy.serviceConfig = {
+
EnvironmentFile = config.age.secrets.cloudflare.path;
+
};
+
+
services.uptime-kuma = {
+
enable = true;
+
settings = {
+
PORT = "3001";
+
};
};
boot.loader.systemd-boot.enable = true;
secrets/cloudflare.age

This is a binary file and will not be displayed.

+3
secrets/secrets.nix
···
"context7.age".publicKeys = [
kierank
];
+
"cloudflare.age".publicKeys = [
+
kierank
+
];
}