45 lines
1.3 KiB
Nix
Executable file
45 lines
1.3 KiB
Nix
Executable file
{ config, pkgs, ... }:
|
|
{
|
|
services.caddy = {
|
|
enable = true;
|
|
email = "admin@srazka.com";
|
|
|
|
# Generated app routes from the panel backend.
|
|
extraConfig = ''
|
|
import /var/lib/containers/routes/routes.caddy
|
|
'';
|
|
|
|
# Authelia's own login portal
|
|
virtualHosts."auth.srazka.com".extraConfig = ''
|
|
reverse_proxy 127.0.0.1:9091
|
|
'';
|
|
|
|
# Every protected site uses this snippet
|
|
virtualHosts."hello.srazka.com".extraConfig = ''
|
|
forward_auth 127.0.0.1:9091 {
|
|
uri /api/authz/forward-auth
|
|
copy_headers Remote-User Remote-Groups Remote-Email Remote-Name
|
|
}
|
|
reverse_proxy 192.168.100.11:80
|
|
'';
|
|
|
|
# Nextcloud — served by local nginx
|
|
# (Authelia forward-auth disabled for now; re-enable by uncommenting the
|
|
# forward_auth block below.)
|
|
virtualHosts."nextcloud.srazka.com".extraConfig = ''
|
|
# forward_auth 127.0.0.1:9091 {
|
|
# uri /api/authz/forward-auth
|
|
# copy_headers Remote-User Remote-Groups Remote-Email Remote-Name
|
|
# }
|
|
reverse_proxy 127.0.0.1:8081
|
|
'';
|
|
|
|
# Forgejo — no Authelia forward-auth, since it would break git over HTTPS
|
|
# and the API. Forgejo handles its own logins.
|
|
virtualHosts."git.srazka.com".extraConfig = ''
|
|
reverse_proxy 127.0.0.1:14921
|
|
'';
|
|
};
|
|
|
|
}
|
|
|