···

       
11
       
11
       
 
       
    package = pkgs.caddy.withPlugins {

     

       
12
       
12
       
 
       
      plugins = [

     

       
13
       
13
       
 
       
        "github.com/caddy-dns/bunny@v1.2.0"

     

       
14
       
14
       
-
       
        "github.com/digilolnet/caddy-bunny-ip@v0.0.0-20250118080727-ef607b8e1644"

     

       
15
       
14
       
 
       
      ];

     

       
16
       
16
       
-
       
      hash = "sha256-j82fgKbh8AcM9jbKUoRKQsAvF/xaUj3pZLdAr9QtST0=";

     

       
15
       
15
       
+
       
      hash = "sha256-bwffi5sWq07DVoPQGgEIN1jnvQKL6c4tFfR9AT9ThD4=";

     

       
17
       
16
       
 
       
    };

     

       
18
       
17
       
 
       
    environmentFile = config.age.secrets.caddy.path;

     

       
19
       
18
       
 
       
    globalConfig = ''

     

       
20
       
19
       
 
       
      email chloe@sapphic.moe

     

       
21
       
21
       
-
       
      servers {

     

       
22
       
22
       
-
       
        trusted_proxies bunny {

     

       
23
       
23
       
-
       
          interval 6h

     

       
24
       
24
       
-
       
          timeout 25s

     

       
25
       
25
       
-
       
        }

     

       
26
       
26
       
-
       
      }

     

       
27
       
20
       
 
       
    '';

     

       
28
       
21
       
 
       
    extraConfig = ''

     

       
29
       
22
       
 
       
      (tls_bunny) {

     
···

       
32
       
25
       
 
       
          resolvers 9.9.9.9 149.112.112.112

     

       
33
       
26
       
 
       
        }

     

       
34
       
27
       
 
       
      }

     

       
35
       
35
       
-
       


     

       
36
       
28
       
 
       
      (common) {

     

       
37
       
29
       
 
       
        encode zstd gzip

     

       
38
       
38
       
-
       
      }

     

       
39
       
39
       
-
       


     

       
40
       
40
       
-
       
      (deny_non_bunny) {

     

       
41
       
41
       
-
       
        @not_bunny not client_ip 127.0.0.1 ::1

     

       
42
       
42
       
-
       
        handle @not_bunny {

     

       
43
       
43
       
-
       
          abort

     

       
44
       
44
       
-
       
        }

     

       
45
       
30
       
 
       
      }

     

       
46
       
31
       
 
       
    '';

     

       
47
       
32
       
 
       
    logFormat = ''

     

···

       
34
       
34
       
 
       
    extraConfig = ''

     

       
35
       
35
       
 
       
      import common

     

       
36
       
36
       
 
       
      import tls_bunny

     

       
37
       
37
       
-
       
      import deny_non_bunny

     

       
38
       
37
       
 
       


     

       
39
       
38
       
 
       
      reverse_proxy http://127.0.0.1:7070

     

       
40
       
39
       
 
       
    '';