Only use DNS challenge for wildcard cert, use Nix to separate vhosts instead of everything in a giant extraConfig blob

Changes

2 changed files (+23/-27)

• Unnamed-Server/default.nix
  • @@ -113,27 +113,20 @@
    environmentFile = "/etc/caddy/env"; # By default only errors are logged logFormat = ""; - globalConfig = '' - acme_dns porkbun { - api_key {env.PORKBUN_API_KEY} - api_secret_key {env.PORKBUN_API_SECRET_KEY} - } - ''; - # It's kinda cumbersome to configure individual vhosts so let's just dump the entire Caddyfile - # Also this stops Nix from adding a default access log file - extraConfig = '' - unnamed.website { + # Make Caddy log to stdout instead of to a log file + virtualHosts = builtins.mapAttrs (k: v: v // { logFormat = ""; }) { + "unnamed.website".extraConfig = '' root * /srv/http/www file_server handle_errors { rewrite * /{err.status_code}.html file_server } - log - } - git.unnamed.website { + ''; + "git.unnamed.website".extraConfig = '' @notgit not header User-Agent *git* proof_of_work @notgit { + # 1 year challenge_timeout 8760h } @assets path /cgit.css /cgit.js /cgit.png /favicon.ico
  • @@ -146,9 +139,14 @@
    env SCRIPT_FILENAME ${pkgs.cgit}/cgit/cgit.cgi } } - log - } - *.unnamed.website { + ''; + "*.unnamed.website".extraConfig = '' + tls { + dns porkbun { + api_key {env.PORKBUN_API_KEY} + api_secret_key {env.PORKBUN_API_SECRET_KEY} + } + } root * /srv/http/{labels.2} handle /cgi-bin/* { reverse_proxy unix//run/fcgiwrap-caddy.sock {
  • @@ -158,17 +156,15 @@
    } } file_server - log - } - {$SECRET_DOMAIN} { + ''; + "{$SECRET_DOMAIN}".extraConfig = '' root * /srv/http/{$SECRET_PATH} file_server - log - } - a.exozy.me ta180m.exozy.me { + ''; + "a.exozy.me ta180m.exozy.me".extraConfig = '' redir https://unnamed.website{uri} permanent - } - ''; + ''; + }; }; # services.cgit configures cgit and fcgiwrap for nginx so it's just more straightforward to do it manually services.fcgiwrap.instances.caddy.socket = {
• flake.lock
  • @@ -61,11 +61,11 @@
    }, "nixpkgs": { "locked": { - "lastModified": 1756787288, - "narHash": "sha256-rw/PHa1cqiePdBxhF66V7R+WAP8WekQ0mCDG4CFqT8Y=", + "lastModified": 1757487488, + "narHash": "sha256-zwE/e7CuPJUWKdvvTCB7iunV4E/+G0lKfv4kk/5Izdg=", "owner": "NixOS", "repo": "nixpkgs", - "rev": "d0fc30899600b9b3466ddb260fd83deb486c32f1", + "rev": "ab0f3607a6c7486ea22229b92ed2d355f1482ee0", "type": "github" }, "original": {