diff options
Diffstat (limited to 'hosts/ganymede')
| -rw-r--r-- | hosts/ganymede/caddy.nix | 69 | ||||
| -rw-r--r-- | hosts/ganymede/config.nix | 23 | ||||
| -rw-r--r-- | hosts/ganymede/nixos.nix | 12 | ||||
| -rw-r--r-- | hosts/ganymede/secrets/caddy-root-ca.key.age | 17 |
4 files changed, 88 insertions, 33 deletions
diff --git a/hosts/ganymede/caddy.nix b/hosts/ganymede/caddy.nix index 06ca720..961b3b2 100644 --- a/hosts/ganymede/caddy.nix +++ b/hosts/ganymede/caddy.nix @@ -1,8 +1,12 @@ { pkgs, lib, + hosts, + config, ... }: { + users.users."caddy".extraGroups = ["fileserver"]; + services.caddy = { package = lib.mkForce (pkgs.caddy.withPlugins { plugins = [ @@ -17,30 +21,63 @@ api_key {env.PORKBUN_API_KEY} api_secret_key {env.PORKBUN_API_SECRET_KEY} } + + pki { + ca local { + name "Ganymede Home CA" + + root { + format pem_file + cert ${pkgs.writeText "caddy-root-ca.crt" hosts.ganymede.caddy-root-ca} + key ${config.collinux.secrets.caddy-root-ca-key.path} + } + } + } ''; virtualHosts = { - "lindsey.williamsfam.us.com".extraConfig = '' - redir https://williams-ryan-lindsey.blogspot.com permanent - ''; + "jta.williamsfam.us.com" = { + logFormat = lib.mkForce '' + output file /var/log/caddy/access-williamsfam.us.com.log + ''; + extraConfig = '' + root * /media/public/www/jta - "daniel.williamsfam.us.com".extraConfig = '' - root * /media/public/www/daniel - file_server - ''; + @hidden path */.* + respond @hidden "Not Found" 404 - "williamsfam.us.com".extraConfig = '' - root * /media/public/www/root - file_server - ''; + file_server + ''; + }; + "lindsey.williamsfam.us.com" = { + logFormat = lib.mkForce '' + output file /var/log/caddy/access-williamsfam.us.com.log + ''; + extraConfig = '' + redir https://williams-ryan-lindsey.blogspot.com permanent + ''; + }; + "daniel.williamsfam.us.com" = { + logFormat = lib.mkForce '' + output file /var/log/caddy/access-williamsfam.us.com.log + ''; + extraConfig = '' + root * /media/public/www/daniel + file_server + ''; + }; + "williamsfam.us.com" = { + logFormat = lib.mkForce '' + output file /var/log/caddy/access-williamsfam.us.com.log + ''; + extraConfig = '' + root * /media/public/www/root + file_server + ''; + }; }; }; - # merge logs from subdomains - services.caddy.virtualHosts."jta.williamsfam.us.com".logFormat = lib.mkForce '' - output file /var/log/caddy/access-williamsfam.us.com.log - ''; - collinux.services.glance.homelabServices."website" = { url = "https://williamsfam.us.com"; icon = "mdi:web"; diff --git a/hosts/ganymede/config.nix b/hosts/ganymede/config.nix index 8964666..f1804e9 100644 --- a/hosts/ganymede/config.nix +++ b/hosts/ganymede/config.nix @@ -9,6 +9,10 @@ }; "caddy-env".file = ./secrets/caddy-env.age; + "caddy-root-ca-key" = { + file = ./secrets/caddy-root-ca.key.age; + owner = "caddy"; + }; "wireguard-privkey" = { file = ./secrets/wg-privkey.age; @@ -33,31 +37,18 @@ minecraft.enable = true; # :19132 ngircd.enable = true; # :6667 - jta = { - enable = true; - port = 8072; - }; - goaccess = { - enable = true; - port = 7890; - }; - btopweb = { - enable = true; - port = 8017; - }; + goaccess.enable = true; + btopweb.enable = true; qbittorrent = { enable = true; port = 8076; }; cgit.enable = true; + filebrowser.enable = true; glance = { enable = true; port = 8081; }; - filebrowser = { - enable = true; - port = 8082; - }; caddy = { enable = true; diff --git a/hosts/ganymede/nixos.nix b/hosts/ganymede/nixos.nix index 314b72a..bbed85c 100644 --- a/hosts/ganymede/nixos.nix +++ b/hosts/ganymede/nixos.nix @@ -1,4 +1,8 @@ -{inputs, ...}: { +{ + inputs, + hosts, + ... +}: { imports = [ inputs.disko.nixosModules.disko inputs.nixos-facter-modules.nixosModules.facter @@ -9,7 +13,13 @@ ./wireguard.nix ]; + security.pki.certificates = [ + hosts.ganymede.caddy-root-ca + ]; + facter.reportPath = ./facter.json; + users.users."collin".extraGroups = ["fileserver"]; + services.fail2ban.enable = true; } diff --git a/hosts/ganymede/secrets/caddy-root-ca.key.age b/hosts/ganymede/secrets/caddy-root-ca.key.age new file mode 100644 index 0000000..0de6b0a --- /dev/null +++ b/hosts/ganymede/secrets/caddy-root-ca.key.age @@ -0,0 +1,17 @@ +-----BEGIN AGE ENCRYPTED FILE----- +YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IGF6QmlsZyBsT0lQ +disvMDdLU1F6aEI4MFltME84cSsweHcwNG90MTJlbGdnSHlMOFFrCjAxM1VJeXVH +WUdrc052blNxRWQ2Z3N1VUlJYllERjR1SVhGQjlPenhuZ0kKLT4gc3NoLWVkMjU1 +MTkgWkVyTFRnIDhxUTJrYWkrcWdjSk4wRzE4NHNrSytVTEZYdC9jc3VlWU1OamFP +UXJMQjQKR2NacHlxV3pOV2hKY3EvbTFCNEVBZ1VyTDJpUUlROUJoZHVuN3h0UUhj +NAotPiBVeS1ncmVhc2UgZyh7T2JZOyUgdUdVCjcyckRMVVhVU2hyUHpKWEYvekJo +M3c3aWN4WUtKcnQvREllUlpVTTk1UGpOUCtLT1Q0bWdDa0NKUWxBSDAyUjcKbUNN +OVY0cTJNQU81eG5ZR3cvNW96MmRCMTlJaDFPUEF2SHNxN2hZCi0tLSBSQ1k5QWN3 +TytEOHZkSkdFd3JXb3ZIYXEvVXVFRXNoN0RmOTkwNWQ2bmNFCvPEuEjBR6lEvAPW +yCqkobzKfnaNhFMP4bvG39yx79V9gi0pE2viz1DuSTkMPiM0xMBtMo2PlAPbE4kt +eYB28dCmU3t6+L/xF0XxZfbTJb8lkH5d4lTd42ysEhH2Z4vOREkcwE8vYs02PfG7 +8HYtVR97nVbl5wu4aIn9xa43LvhzIL+h2Gqw5tjieLcpOiHPx0Aq9HtFeFQHmgli +UYoKNLyB8ech1Nuhp2CWhfU5U0Rvvak0o2PuXQ2tUR+uq5ZgesQVTHXcXar/HDGV +D5GFJseS4YByZfARNsVmDQFXg9rRiimesmjIkhlsY4DCC5UL0i4kELFUshPxj21K +4y0UWPh4Pa+t +-----END AGE ENCRYPTED FILE----- |