From 6427ffd9c39eea3ac07813166304aede82615ed1 Mon Sep 17 00:00:00 2001 From: Wekuz Date: Fri, 26 Jun 2026 23:52:58 +0300 Subject: [PATCH] temp: Caddy --- hosts/plexy/default.nix | 104 +++++++++++++++++++++++++++++++++++++++ hosts/plexy/glance.nix | 1 - hosts/plexy/secrets.yaml | 11 +++-- 3 files changed, 110 insertions(+), 6 deletions(-) diff --git a/hosts/plexy/default.nix b/hosts/plexy/default.nix index 47a72cc..7146d2f 100644 --- a/hosts/plexy/default.nix +++ b/hosts/plexy/default.nix @@ -96,6 +96,7 @@ secrets = { "vaultwarden.env" = { }; "rsyncd.secrets" = { }; + "caddy.env" = { }; }; }; @@ -143,6 +144,109 @@ }; }; }; + caddy = { + enable = true; + package = pkgs.caddy.withPlugins { + plugins = [ + "github.com/caddy-dns/cloudflare@v0.2.4" + "github.com/WeidiDeng/caddy-cloudflare-ip@v0.0.0-20231130002422-f53b62aa13cb" + "github.com/mholt/caddy-l4@v0.1.2" + "github.com/caddyserver/transform-encoder@v0.0.0-20260423033309-ba4124974830" + "github.com/hslatman/caddy-crowdsec-bouncer/http@v0.14.1" + "github.com/hslatman/caddy-crowdsec-bouncer/appsec@v0.14.1" + "github.com/hslatman/caddy-crowdsec-bouncer/layer4@v0.14.1" + ]; + hash = "sha256-5kC1Rcrgxco/26B4Tb6h7bictQ3j8rycxH+3Rr28Fa0="; + doInstallCheck = false; # Because caddy-crowdsec-bouncer plugins are in subdirectories + }; + environmentFile = config.sops.secrets."caddy.env".path; + logFormat = '' + level INFO + ''; + globalConfig = '' + grace_period 10s + servers { + trusted_proxies cloudflare { + interval 1h + timeout 20s + } + trusted_proxies_strict + client_ip_headers Cf-Connecting-Ip X-Forwarded-For + } + crowdsec { + api_url http://127.0.0.1:8080 + api_key {$CROWDSEC_APIKEY} + ticker_interval 10s + } + ''; + extraConfig = '' + (proxy-route) { + route { + crowdsec + reverse_proxy {args[0]} { + # Strip intermediary proxies + header_up X-Forwarded-For {client_ip} + header_up X-Real-IP {client_ip} + } + } + } + ''; + virtualHosts = { + "*.wekuz.localplayer.dev" = { + logFormat = '' + output stdout + format json + ''; + extraConfig = '' + tls { + dns cloudflare {$CF_APIKEY} + } + ''; + }; + + "glance.wekuz.localplayer.dev" = { + logFormat = null; + extraConfig = '' + import proxy-route http://localhost:15835 + ''; + }; + + "vw.wekuz.localplayer.dev" = { + logFormat = null; + extraConfig = '' + import proxy-route http://192.168.1.111:15830 + ''; + }; + + "lw.wekuz.localplayer.dev" = { + logFormat = null; + extraConfig = '' + import proxy-route http://192.168.1.111:15834 + ''; + }; + + "git.wekuz.localplayer.dev" = { + logFormat = null; + extraConfig = '' + import proxy-route http://192.168.1.111:15836 + ''; + }; + + "tv.wekuz.localplayer.dev" = { + logFormat = null; + extraConfig = '' + import proxy-route http://localhost:8096 + ''; + }; + + "seerr.wekuz.localplayer.dev" = { + logFormat = null; + extraConfig = '' + import proxy-route http://localhost:5055 + ''; + }; + }; + }; vaultwarden = { enable = true; environmentFile = config.sops.secrets."vaultwarden.env".path; diff --git a/hosts/plexy/glance.nix b/hosts/plexy/glance.nix index 143573e..1098e36 100644 --- a/hosts/plexy/glance.nix +++ b/hosts/plexy/glance.nix @@ -2,7 +2,6 @@ server = { host = "0.0.0.0"; port = 15835; - assets-path = "/var/lib/glance/assets"; }; theme = { light = false; diff --git a/hosts/plexy/secrets.yaml b/hosts/plexy/secrets.yaml index 2390d9a..fed903b 100644 --- a/hosts/plexy/secrets.yaml +++ b/hosts/plexy/secrets.yaml @@ -1,9 +1,9 @@ vaultwarden.env: ENC[AES256_GCM,data:PLNb5cFoJaOyUo5U/gpXH0RGVwwQxL3kCE/OLw7MaLWazuBGHIPUEhH+kDMP2cfF916D63w8Ddgb/oH+lHGCw235YwgoqZ9yjWYPG4VB2Jdw+17LeCbirdh3zv8nNzFnSZDJmhz5Pj82+iswju6sYO/H7UfZ3aeASWonKW9LGHVltKSY1rAVhZRu4SvhqPiAxNpEzN0/EDTl46RIxrgEoUraN+Ie8fh1wU9SKevExkPU3NXGO1gG2tWRxclMPgc=,iv:es40/5HpBAhOy2xmU/yCUD43fVVsAXk6qJ3OasKjK3U=,tag:bneErU9pPZkQ2VzbQ1NrJA==,type:str] rsyncd.secrets: ENC[AES256_GCM,data:VjHRoZa6/lDtCheKSJyM,iv:kxygNaKOuK0iH/bFY/uKxcbMcYSR8nWDUx+4aDNqTMk=,tag:uYYPWAPCWtvLLGwmOWyH+A==,type:str] +caddy.env: ENC[AES256_GCM,data:xzYvGvtu1DDBWvcLmohHUAOTNQfUuLbOJ18UPgLokkWlzf7peNgN3Qt9A/ZCuEm5cg4PLtJy0LYbWk6ykm20vgDW+TmouJ8dxqwSDvJHdmnhoPYCfu0KA1d3iHPL5f8unqXxxhAbcfp0VSzxUo685on9Aw==,iv:E+o8dJ+t4BPuoiEfkTaOO6lVDAZnG9D1btNYN9oX3ek=,tag:oar1at1PkK4tgIDIXCyXrg==,type:str] sops: age: - - recipient: age1sqssntfzzlhcgp0wuf9wmeavg0hmwmq349npsq8vaxj9sxey5s9ssc82sw - enc: | + - enc: | -----BEGIN AGE ENCRYPTED FILE----- YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBXSERvcGNXdDlUb3NBUm40 WW1mVlY5YlpxclBxT3htQ1orbHpxTnBUTEJNCkZaZnUzZUZNQmk0RmU2U2RkOUVI @@ -11,7 +11,8 @@ sops: eDUxR1V0ZEFSYnZTYnYzakFydEliaFUKoa/gHecAy01vTk7I02KMGGPHZBql5K48 hkLDjoWK9dkGRX8kqRd028cuMCQRenLpULEECWp6oV+evUdMf7wRtg== -----END AGE ENCRYPTED FILE----- - lastmodified: "2026-04-03T15:46:07Z" - mac: ENC[AES256_GCM,data:gh9Voy28Lo4G1qwQ7/WVAt/L3SAXIY5bs5fdCE0Oywi0ZV4YTJI5VCAcfxuE0Fc3DXdHF0/LORGjKa2l0yp5msMdBVpzI46FBiwYvU+w7EfEoEmhu0yMLf0SZmXkVLEq8u2uVFHGVbR1dOKcdFef+qTIGTlz4cE9VQ01xg/nh7g=,iv:fasXOAm2hjB4ULKT4vPOFnFpAcEgSeNvNM7Zrnk6MvM=,tag:1hWtpuTVdC3H8flA1m0Z0A==,type:str] + recipient: age1sqssntfzzlhcgp0wuf9wmeavg0hmwmq349npsq8vaxj9sxey5s9ssc82sw + lastmodified: "2026-06-26T20:44:20Z" + mac: ENC[AES256_GCM,data:GxcbV3hdk86tNZlzCcQTG0X206tpwxzkACO5KEF/T+ScvKIrbCYKVfQKmdEBR6/o1oSBP8R5kiNdsQu3ETpsVeb4GRtp3E/C41a7mOXtagvNo0id+kSmZFJNOgl1ki+8mPjZEO3m5IBnQgy1HtfGXe4Dbnk6iaDyyBl7ukJdXYY=,iv:djI/xYTI/WzQaihC2OZiry9swvkKB4LyrJglf2E71NE=,tag:d1Uzu7tVSQqkLMKZ3EZ/fA==,type:str] unencrypted_suffix: _unencrypted - version: 3.12.2 + version: 3.13.1