mirror of
https://github.com/nmasur/dotfiles
synced 2024-11-09 16:22:56 +00:00
cloudflare caddy module for dns validation
This commit is contained in:
parent
8cc158221d
commit
df5fba19f8
@ -2,6 +2,11 @@
|
||||
|
||||
options = {
|
||||
caddy.enable = lib.mkEnableOption "Caddy reverse proxy.";
|
||||
caddy.tlsPolicies = lib.mkOption {
|
||||
type = lib.types.listOf lib.types.attrs;
|
||||
description = "Caddy JSON TLS policies";
|
||||
default = [ ];
|
||||
};
|
||||
caddy.routes = lib.mkOption {
|
||||
type = lib.types.listOf lib.types.attrs;
|
||||
description = "Caddy JSON routes for http servers";
|
||||
@ -26,6 +31,7 @@
|
||||
errors.routes = config.caddy.blocks;
|
||||
# logs = { }; # Uncomment to collect access logs
|
||||
};
|
||||
apps.tls.automation.policies = config.caddy.tlsPolicies;
|
||||
logging.logs.main = {
|
||||
encoder = { format = "console"; };
|
||||
writer = {
|
||||
|
@ -1,6 +1,6 @@
|
||||
# This module is necessary for hosts that are serving through Cloudflare.
|
||||
|
||||
{ config, lib, ... }:
|
||||
{ config, pkgs, lib, ... }:
|
||||
|
||||
let
|
||||
|
||||
@ -34,6 +34,41 @@ let
|
||||
|
||||
];
|
||||
|
||||
# Build with Cloudflare plugin for DNS validation
|
||||
# Otherwise, requires HTTPS to be disabled for issuance
|
||||
caddy = pkgs.stdenv.mkDerivation rec {
|
||||
pname = "caddy";
|
||||
version = "latest";
|
||||
dontUnpack = true;
|
||||
|
||||
nativeBuildInputs = with pkgs; [ git go xcaddy ];
|
||||
|
||||
plugins = [
|
||||
"github.com/caddy-dns/cloudflare@a9d3ae2690a1d232bc9f8fc8b15bd4e0a6960eec"
|
||||
];
|
||||
|
||||
configurePhase = ''
|
||||
export GOCACHE=$TMPDIR/go-cache
|
||||
export GOPATH="$TMPDIR/go"
|
||||
'';
|
||||
|
||||
buildPhase = let
|
||||
pluginArgs =
|
||||
lib.concatMapStringsSep " " (plugin: "--with ${plugin}") plugins;
|
||||
in ''
|
||||
runHook preBuild
|
||||
${pkgs.xcaddy}/bin/xcaddy build "v${version}" ${pluginArgs}
|
||||
runHook postBuild
|
||||
'';
|
||||
|
||||
installPhase = ''
|
||||
runHook preInstall
|
||||
mkdir -p $out/bin
|
||||
mv caddy $out/bin
|
||||
runHook postInstall
|
||||
'';
|
||||
};
|
||||
|
||||
in {
|
||||
|
||||
options.cloudflare.enable = lib.mkEnableOption "Use Cloudflare.";
|
||||
@ -49,6 +84,30 @@ in {
|
||||
}];
|
||||
}];
|
||||
|
||||
# Tell Caddy to use Cloudflare DNS for ACME challenge validation
|
||||
services.caddy.package = caddy;
|
||||
caddy.tlsPolicies = [{
|
||||
issuers = [{
|
||||
module = "acme";
|
||||
challenges = {
|
||||
dns.provider = {
|
||||
name = "cloudflare";
|
||||
api_token = "{env.CF_API_TOKEN}";
|
||||
};
|
||||
};
|
||||
}];
|
||||
}];
|
||||
systemd.services.caddy.serviceConfig.EnvironmentFile =
|
||||
config.secrets.cloudflareApi.dest;
|
||||
|
||||
# API key must have access to modify Cloudflare DNS records
|
||||
secrets.cloudflareApi = {
|
||||
source = ../../../private/cloudflare-api.age;
|
||||
dest = "${config.secretsDirectory}/cloudflare-api";
|
||||
owner = "caddy";
|
||||
group = "caddy";
|
||||
};
|
||||
|
||||
# Allows Nextcloud to trust Cloudflare IPs
|
||||
services.nextcloud.config.trustedProxies = cloudflareIpRanges;
|
||||
|
||||
|
13
private/cloudflare-api.age
Normal file
13
private/cloudflare-api.age
Normal file
@ -0,0 +1,13 @@
|
||||
-----BEGIN AGE ENCRYPTED FILE-----
|
||||
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IE1nSGFPdyByWGJS
|
||||
SmJlSVhZcUx5Y3JhVXYxUVhUbmp2QjNXeUxYL1EwNThJelRoTVNvCjFsU0gyaWNJ
|
||||
SEJpNVpYWm1TL24yeHNLaWNIdU9FdWw2d3p6UVVMSEYwT28KLT4gc3NoLWVkMjU1
|
||||
MTkgWXlTVU1RIEV4NU1sOENFK1NvUWlZL1NmUCtUM2RRQmd1c2pnb3p6V3Bsc3pC
|
||||
UVdYV3cKYmFkR0EwNVpRbzJBb2Z4RmpXSGVyK3BkLzd6TTMvQWRRK3BtRXZDUjVZ
|
||||
UQotPiBzc2gtZWQyNTUxOSBuanZYNUEgMG9rU0lzTU1iV1grOTNzZS85cldQZGE5
|
||||
Ym9nVkRvNC9OMUFBbStNT1BBOApucnl1Z0w1Y1RRU3grS0Z0TjNNRXcwVnVqeDFF
|
||||
VGc3Mm93UFc0YXoweVBBCi0tLSBvTnpCc3hBVU81dkpBRzV2L3NWTlZaV2QxUVNZ
|
||||
KzJwcUI2QUl2NEY0R1p3CmDvQwsKrtmTJliCxHv+LSoIV8jYpQJ7I2LJSH9uP89N
|
||||
+7wbAwGjv/Uxk7gnMn5EqQuFKZeOl8LLhKEprmVqVZqlkgbpaaaWud/4xNKu9v5h
|
||||
lWuY1sYd
|
||||
-----END AGE ENCRYPTED FILE-----
|
Loading…
Reference in New Issue
Block a user