dotfiles/modules/nixos/services/caddy.nix

73 lines
2.1 KiB
Nix
Raw Normal View History

2022-10-13 23:40:30 +00:00
{ config, pkgs, lib, ... }: {
2022-10-02 15:24:25 +00:00
options = {
2023-07-18 03:52:37 +00:00
caddy = {
tlsPolicies = lib.mkOption {
type = lib.types.listOf lib.types.attrs;
description = "Caddy JSON TLS policies";
default = [ ];
};
routes = lib.mkOption {
type = lib.types.listOf lib.types.attrs;
description = "Caddy JSON routes for http servers";
default = [ ];
};
blocks = lib.mkOption {
type = lib.types.listOf lib.types.attrs;
description = "Caddy JSON error blocks for http servers";
default = [ ];
};
cidrAllowlist = lib.mkOption {
type = lib.types.listOf lib.types.str;
description = "CIDR blocks to allow for requests";
default = [ ];
2023-07-18 03:52:37 +00:00
};
2022-10-15 19:00:37 +00:00
};
2022-10-02 15:24:25 +00:00
};
2023-07-18 03:52:37 +00:00
config = lib.mkIf config.services.caddy.enable {
# Force Caddy to 403 if not coming from allowlisted source
caddy.cidrAllowlist = [ "127.0.0.1/32" ];
2023-07-18 03:52:37 +00:00
caddy.routes = [{
match = [{ not = [{ remote_ip.ranges = config.caddy.cidrAllowlist; }]; }];
handle = [{
handler = "static_response";
status_code = "403";
}];
}];
services.caddy = {
adapter = "''"; # Required to enable JSON
configFile = pkgs.writeText "Caddyfile" (builtins.toJSON {
apps.http.servers.main = {
listen = [ ":443" ];
routes = config.caddy.routes;
errors.routes = config.caddy.blocks;
2023-08-04 05:13:43 +00:00
logs = { }; # Uncomment to collect access logs
2023-07-18 03:52:37 +00:00
};
apps.http.servers.metrics = { }; # Enables Prometheus metrics
apps.tls.automation.policies = config.caddy.tlsPolicies;
logging.logs.main = {
encoder = { format = "console"; };
writer = {
output = "file";
filename = "${config.services.caddy.logDir}/caddy.log";
roll = true;
2023-08-04 05:13:43 +00:00
roll_size_mb = 1;
};
2023-07-18 03:52:37 +00:00
level = "INFO";
};
});
2022-10-02 15:24:25 +00:00
2023-07-18 03:52:37 +00:00
};
2022-10-02 15:24:25 +00:00
2023-07-18 03:52:37 +00:00
networking.firewall.allowedTCPPorts = [ 80 443 ];
networking.firewall.allowedUDPPorts = [ 443 ];
2022-10-03 12:19:29 +00:00
2023-07-18 03:52:37 +00:00
prometheus.scrapeTargets = [ "127.0.0.1:2019" ];
2023-07-16 20:13:41 +00:00
2023-07-18 03:52:37 +00:00
};
2022-10-02 15:24:25 +00:00
}