nixos/caddy.nix
agent a3c730e1db Move all services from srazka.com to reudy.net
Renames every domain in the config: Caddy virtual hosts (auth, hello,
nextcloud, git, panel), the ACME contact email, Authelia's session cookie
domain / portal URL / default redirect and TOTP issuer, Nextcloud's
hostName and overwritehost, and Forgejo's DOMAIN (ROOT_URL and ssh clone
URLs follow from it; the panel picks them up via panel.nix). Panel docs and
examples updated too, and a README paragraph that had run together is
split again.

Requires DNS for auth/hello/nextcloud/git/panel.reudy.net (or a
*.reudy.net wildcard) pointing at the server before deploying.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01UbWSNkXxZhYf7eqHTyx3Bf
2026-09-27 15:32:49 +00:00

45 lines
1.3 KiB
Nix
Executable file

{ config, pkgs, ... }:
{
services.caddy = {
enable = true;
email = "admin@reudy.net";
# Generated app routes from the panel backend.
extraConfig = ''
import /var/lib/containers/routes/routes.caddy
'';
# Authelia's own login portal
virtualHosts."auth.reudy.net".extraConfig = ''
reverse_proxy 127.0.0.1:9091
'';
# Every protected site uses this snippet
virtualHosts."hello.reudy.net".extraConfig = ''
forward_auth 127.0.0.1:9091 {
uri /api/authz/forward-auth
copy_headers Remote-User Remote-Groups Remote-Email Remote-Name
}
reverse_proxy 192.168.100.11:80
'';
# Nextcloud — served by local nginx
# (Authelia forward-auth disabled for now; re-enable by uncommenting the
# forward_auth block below.)
virtualHosts."nextcloud.reudy.net".extraConfig = ''
# forward_auth 127.0.0.1:9091 {
# uri /api/authz/forward-auth
# copy_headers Remote-User Remote-Groups Remote-Email Remote-Name
# }
reverse_proxy 127.0.0.1:8081
'';
# Forgejo — no Authelia forward-auth, since it would break git over HTTPS
# and the API. Forgejo handles its own logins.
virtualHosts."git.reudy.net".extraConfig = ''
reverse_proxy 127.0.0.1:14921
'';
};
}