65 lines
2.2 KiB
Nix
65 lines
2.2 KiB
Nix
{ config, ... }:
|
|
let
|
|
homelabDomain = inputs.nixos-secrets.homelabDomain;
|
|
certDir = config.security.acme.certs."${homelabDomain}".directory;
|
|
in
|
|
{
|
|
sops.secrets."cloudflare/dns_api_token" = {
|
|
mode = "0440";
|
|
group = config.services.caddy.group;
|
|
restartUnits = [ "caddy.service" "ddclient.service" ];
|
|
};
|
|
|
|
|
|
# TODO: Consider defining reverse proxy all in one location.
|
|
# All the ports and domains would be visible in one place.
|
|
security.acme = {
|
|
acceptTerms = true;
|
|
defaults = {
|
|
# NOTE: Uncomment the following line for testing, comment for production.
|
|
server = "https://acme-staging-v02.api.letsencrypt.org/directory";
|
|
dnsProvider = "cloudflare";
|
|
dnsResolver = "1.1.1.1:53";
|
|
dnsPropagationCheck = true;
|
|
credentialFiles = {
|
|
CLOUDFLARE_DNS_API_TOKEN_FILE = config.sops.secrets."cloudflare/dns_api_token".path;
|
|
};
|
|
group = config.services.caddy.group;
|
|
#reloadServices = [ "caddy" ];
|
|
email = "admin+acme@${homelabDomain}"; # NOTE: This email is /dev/null;
|
|
#keyType = "ec384";
|
|
};
|
|
};
|
|
|
|
services.ddclient = {
|
|
enable = true;
|
|
protocol = "cloudflare";
|
|
usev4 = "webv4, webv4=https://cloudflare.com/cdn-cgi/trace, web-skip='ip='";
|
|
username = "token";
|
|
#secretsFile = config.sops.secrets."cloudflare/dns_api_token".path;
|
|
passwordFile = config.sops.secrets."cloudflare/dns_api_token".path;
|
|
zone = homelabDomain;
|
|
domains = [
|
|
homelabDomain
|
|
"*.${homelabDomain}"
|
|
"id.${homelabDomain}"
|
|
"status.${homelabDomain}"
|
|
"grafana.${homelabDomain}"
|
|
"feeds.${homelabDomain}"
|
|
"git.${homelabDomain}"
|
|
"tv.${homelabDomain}"
|
|
"demo.${homelabDomain}" # Testing to see if the DNS record is set.
|
|
];
|
|
};
|
|
|
|
# NOTE: Issue a single cert /w subdomain wildcard
|
|
# At the expense of individual service security, some public details about
|
|
# attack surface remain slightly more private in https://crt.sh/
|
|
security.acme.certs."${homelabDomain}" = {
|
|
#group = config.services.caddy.group;
|
|
domain = "${homelabDomain}";
|
|
extraDomainNames = [ "*.${homelabDomain}" ];
|
|
};
|
|
# Nginx useACMEHost provides the DNS-01 challenge.
|
|
# security.acme.certs."${homelabDomain}".directory
|
|
}
|