From bc81e75bead05fdf2cb6aaf3fec6e933ce8feb1a Mon Sep 17 00:00:00 2001
From: Collin Williams <96917990+bluedragon1221@users.noreply.github.com>
Date: Sat, 22 Aug 2026 12:42:46 -0500
Subject: everything is working now

---
 hosts/ganymede/caddy.nix                     | 73 +++++++++++++++++++++-------
 hosts/ganymede/config.nix                    | 23 +++------
 hosts/ganymede/nixos.nix                     | 12 ++++-
 hosts/ganymede/secrets/caddy-root-ca.key.age | 17 +++++++
 4 files changed, 90 insertions(+), 35 deletions(-)
 create mode 100644 hosts/ganymede/secrets/caddy-root-ca.key.age

(limited to 'hosts/ganymede')

diff --git a/hosts/ganymede/caddy.nix b/hosts/ganymede/caddy.nix
index 06ca720..961b3b2 100644
--- a/hosts/ganymede/caddy.nix
+++ b/hosts/ganymede/caddy.nix
@@ -1,8 +1,12 @@
 {
   pkgs,
   lib,
+  hosts,
+  config,
   ...
 }: {
+  users.users."caddy".extraGroups = ["fileserver"];
+
   services.caddy = {
     package = lib.mkForce (pkgs.caddy.withPlugins {
       plugins = [
@@ -17,30 +21,63 @@
         api_key {env.PORKBUN_API_KEY}
         api_secret_key {env.PORKBUN_API_SECRET_KEY}
       }
+
+      pki {
+        ca local {
+          name "Ganymede Home CA"
+
+          root {
+              format pem_file
+              cert ${pkgs.writeText "caddy-root-ca.crt" hosts.ganymede.caddy-root-ca}
+              key ${config.collinux.secrets.caddy-root-ca-key.path}
+          }
+        }
+      }
     '';
 
     virtualHosts = {
-      "lindsey.williamsfam.us.com".extraConfig = ''
-        redir https://williams-ryan-lindsey.blogspot.com permanent
-      '';
-
-      "daniel.williamsfam.us.com".extraConfig = ''
-        root * /media/public/www/daniel
-        file_server
-      '';
-
-      "williamsfam.us.com".extraConfig = ''
-        root * /media/public/www/root
-        file_server
-      '';
+      "jta.williamsfam.us.com" = {
+        logFormat = lib.mkForce ''
+          output file /var/log/caddy/access-williamsfam.us.com.log
+        '';
+        extraConfig = ''
+          root * /media/public/www/jta
+
+          @hidden path */.*
+          respond @hidden "Not Found" 404
+
+          file_server
+        '';
+      };
+      "lindsey.williamsfam.us.com" = {
+        logFormat = lib.mkForce ''
+          output file /var/log/caddy/access-williamsfam.us.com.log
+        '';
+        extraConfig = ''
+          redir https://williams-ryan-lindsey.blogspot.com permanent
+        '';
+      };
+      "daniel.williamsfam.us.com" = {
+        logFormat = lib.mkForce ''
+          output file /var/log/caddy/access-williamsfam.us.com.log
+        '';
+        extraConfig = ''
+          root * /media/public/www/daniel
+          file_server
+        '';
+      };
+      "williamsfam.us.com" = {
+        logFormat = lib.mkForce ''
+          output file /var/log/caddy/access-williamsfam.us.com.log
+        '';
+        extraConfig = ''
+          root * /media/public/www/root
+          file_server
+        '';
+      };
     };
   };
 
-  # merge logs from subdomains
-  services.caddy.virtualHosts."jta.williamsfam.us.com".logFormat = lib.mkForce ''
-    output file /var/log/caddy/access-williamsfam.us.com.log
-  '';
-
   collinux.services.glance.homelabServices."website" = {
     url = "https://williamsfam.us.com";
     icon = "mdi:web";
diff --git a/hosts/ganymede/config.nix b/hosts/ganymede/config.nix
index 8964666..f1804e9 100644
--- a/hosts/ganymede/config.nix
+++ b/hosts/ganymede/config.nix
@@ -9,6 +9,10 @@
       };
 
       "caddy-env".file = ./secrets/caddy-env.age;
+      "caddy-root-ca-key" = {
+        file = ./secrets/caddy-root-ca.key.age;
+        owner = "caddy";
+      };
 
       "wireguard-privkey" = {
         file = ./secrets/wg-privkey.age;
@@ -33,31 +37,18 @@
       minecraft.enable = true; # :19132
       ngircd.enable = true; # :6667
 
-      jta = {
-        enable = true;
-        port = 8072;
-      };
-      goaccess = {
-        enable = true;
-        port = 7890;
-      };
-      btopweb = {
-        enable = true;
-        port = 8017;
-      };
+      goaccess.enable = true;
+      btopweb.enable = true;
       qbittorrent = {
         enable = true;
         port = 8076;
       };
       cgit.enable = true;
+      filebrowser.enable = true;
       glance = {
         enable = true;
         port = 8081;
       };
-      filebrowser = {
-        enable = true;
-        port = 8082;
-      };
 
       caddy = {
         enable = true;
diff --git a/hosts/ganymede/nixos.nix b/hosts/ganymede/nixos.nix
index 314b72a..bbed85c 100644
--- a/hosts/ganymede/nixos.nix
+++ b/hosts/ganymede/nixos.nix
@@ -1,4 +1,8 @@
-{inputs, ...}: {
+{
+  inputs,
+  hosts,
+  ...
+}: {
   imports = [
     inputs.disko.nixosModules.disko
     inputs.nixos-facter-modules.nixosModules.facter
@@ -9,7 +13,13 @@
     ./wireguard.nix
   ];
 
+  security.pki.certificates = [
+    hosts.ganymede.caddy-root-ca
+  ];
+
   facter.reportPath = ./facter.json;
 
+  users.users."collin".extraGroups = ["fileserver"];
+
   services.fail2ban.enable = true;
 }
diff --git a/hosts/ganymede/secrets/caddy-root-ca.key.age b/hosts/ganymede/secrets/caddy-root-ca.key.age
new file mode 100644
index 0000000..0de6b0a
--- /dev/null
+++ b/hosts/ganymede/secrets/caddy-root-ca.key.age
@@ -0,0 +1,17 @@
+-----BEGIN AGE ENCRYPTED FILE-----
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IGF6QmlsZyBsT0lQ
+disvMDdLU1F6aEI4MFltME84cSsweHcwNG90MTJlbGdnSHlMOFFrCjAxM1VJeXVH
+WUdrc052blNxRWQ2Z3N1VUlJYllERjR1SVhGQjlPenhuZ0kKLT4gc3NoLWVkMjU1
+MTkgWkVyTFRnIDhxUTJrYWkrcWdjSk4wRzE4NHNrSytVTEZYdC9jc3VlWU1OamFP
+UXJMQjQKR2NacHlxV3pOV2hKY3EvbTFCNEVBZ1VyTDJpUUlROUJoZHVuN3h0UUhj
+NAotPiBVeS1ncmVhc2UgZyh7T2JZOyUgdUdVCjcyckRMVVhVU2hyUHpKWEYvekJo
+M3c3aWN4WUtKcnQvREllUlpVTTk1UGpOUCtLT1Q0bWdDa0NKUWxBSDAyUjcKbUNN
+OVY0cTJNQU81eG5ZR3cvNW96MmRCMTlJaDFPUEF2SHNxN2hZCi0tLSBSQ1k5QWN3
+TytEOHZkSkdFd3JXb3ZIYXEvVXVFRXNoN0RmOTkwNWQ2bmNFCvPEuEjBR6lEvAPW
+yCqkobzKfnaNhFMP4bvG39yx79V9gi0pE2viz1DuSTkMPiM0xMBtMo2PlAPbE4kt
+eYB28dCmU3t6+L/xF0XxZfbTJb8lkH5d4lTd42ysEhH2Z4vOREkcwE8vYs02PfG7
+8HYtVR97nVbl5wu4aIn9xa43LvhzIL+h2Gqw5tjieLcpOiHPx0Aq9HtFeFQHmgli
+UYoKNLyB8ech1Nuhp2CWhfU5U0Rvvak0o2PuXQ2tUR+uq5ZgesQVTHXcXar/HDGV
+D5GFJseS4YByZfARNsVmDQFXg9rRiimesmjIkhlsY4DCC5UL0i4kELFUshPxj21K
+4y0UWPh4Pa+t
+-----END AGE ENCRYPTED FILE-----
-- 
cgit v1.3.1