temp: Caddy

hosts/plexy/default.nix

@@ -96,6 +96,7 @@
     secrets = {
       "vaultwarden.env" = { };
       "rsyncd.secrets" = { };
+      "caddy.env" = { };
     };
   };
 
@@ -143,6 +144,109 @@
         };
       };
     };
+    caddy = {
+      enable = true;
+      package = pkgs.caddy.withPlugins {
+        plugins = [
+          "github.com/caddy-dns/cloudflare@v0.2.4"
+          "github.com/WeidiDeng/caddy-cloudflare-ip@v0.0.0-20231130002422-f53b62aa13cb"
+          "github.com/mholt/caddy-l4@v0.1.2"
+          "github.com/caddyserver/transform-encoder@v0.0.0-20260423033309-ba4124974830"
+          "github.com/hslatman/caddy-crowdsec-bouncer/http@v0.14.1"
+          "github.com/hslatman/caddy-crowdsec-bouncer/appsec@v0.14.1"
+          "github.com/hslatman/caddy-crowdsec-bouncer/layer4@v0.14.1"
+        ];
+        hash = "sha256-5kC1Rcrgxco/26B4Tb6h7bictQ3j8rycxH+3Rr28Fa0=";
+        doInstallCheck = false; # Because caddy-crowdsec-bouncer plugins are in subdirectories
+      };
+      environmentFile = config.sops.secrets."caddy.env".path;
+      logFormat = ''
+        level INFO
+      '';
+      globalConfig = ''
+        grace_period 10s
+        servers {
+            trusted_proxies cloudflare {
+                interval 1h
+                timeout 20s
+            }
+            trusted_proxies_strict
+            client_ip_headers Cf-Connecting-Ip X-Forwarded-For
+        }
+        crowdsec {
+            api_url http://127.0.0.1:8080
+            api_key {$CROWDSEC_APIKEY}
+            ticker_interval 10s
+        }
+      '';
+      extraConfig = ''
+        (proxy-route) {
+            route {
+                crowdsec
+                reverse_proxy {args[0]} {
+                    # Strip intermediary proxies
+                    header_up X-Forwarded-For {client_ip}
+                    header_up X-Real-IP {client_ip}
+                }
+            }
+        }
+      '';
+      virtualHosts = {
+        "*.wekuz.localplayer.dev" = {
+          logFormat = ''
+            output stdout
+            format json
+          '';
+          extraConfig = ''
+            tls {
+                dns cloudflare {$CF_APIKEY}
+            }
+          '';
+        };
+
+        "glance.wekuz.localplayer.dev" = {
+          logFormat = null;
+          extraConfig = ''
+            import proxy-route http://localhost:15835
+          '';
+        };
+
+        "vw.wekuz.localplayer.dev" = {
+          logFormat = null;
+          extraConfig = ''
+            import proxy-route http://192.168.1.111:15830
+          '';
+        };
+
+        "lw.wekuz.localplayer.dev" = {
+          logFormat = null;
+          extraConfig = ''
+            import proxy-route http://192.168.1.111:15834
+          '';
+        };
+
+        "git.wekuz.localplayer.dev" = {
+          logFormat = null;
+          extraConfig = ''
+            import proxy-route http://192.168.1.111:15836
+          '';
+        };
+
+        "tv.wekuz.localplayer.dev" = {
+          logFormat = null;
+          extraConfig = ''
+            import proxy-route http://localhost:8096
+          '';
+        };
+
+        "seerr.wekuz.localplayer.dev" = {
+          logFormat = null;
+          extraConfig = ''
+            import proxy-route http://localhost:5055
+          '';
+        };
+      };
+    };
     vaultwarden = {
       enable = true;
       environmentFile = config.sops.secrets."vaultwarden.env".path;

hosts/plexy/glance.nix

@@ -2,7 +2,6 @@
   server = {
     host = "0.0.0.0";
     port = 15835;
-    assets-path = "/var/lib/glance/assets";
   };
   theme = {
     light = false;

hosts/plexy/secrets.yaml

@@ -1,9 +1,9 @@
 vaultwarden.env: ENC[AES256_GCM,data:PLNb5cFoJaOyUo5U/gpXH0RGVwwQxL3kCE/OLw7MaLWazuBGHIPUEhH+kDMP2cfF916D63w8Ddgb/oH+lHGCw235YwgoqZ9yjWYPG4VB2Jdw+17LeCbirdh3zv8nNzFnSZDJmhz5Pj82+iswju6sYO/H7UfZ3aeASWonKW9LGHVltKSY1rAVhZRu4SvhqPiAxNpEzN0/EDTl46RIxrgEoUraN+Ie8fh1wU9SKevExkPU3NXGO1gG2tWRxclMPgc=,iv:es40/5HpBAhOy2xmU/yCUD43fVVsAXk6qJ3OasKjK3U=,tag:bneErU9pPZkQ2VzbQ1NrJA==,type:str]
 rsyncd.secrets: ENC[AES256_GCM,data:VjHRoZa6/lDtCheKSJyM,iv:kxygNaKOuK0iH/bFY/uKxcbMcYSR8nWDUx+4aDNqTMk=,tag:uYYPWAPCWtvLLGwmOWyH+A==,type:str]
+caddy.env: ENC[AES256_GCM,data:xzYvGvtu1DDBWvcLmohHUAOTNQfUuLbOJ18UPgLokkWlzf7peNgN3Qt9A/ZCuEm5cg4PLtJy0LYbWk6ykm20vgDW+TmouJ8dxqwSDvJHdmnhoPYCfu0KA1d3iHPL5f8unqXxxhAbcfp0VSzxUo685on9Aw==,iv:E+o8dJ+t4BPuoiEfkTaOO6lVDAZnG9D1btNYN9oX3ek=,tag:oar1at1PkK4tgIDIXCyXrg==,type:str]
 sops:
     age:
-        - recipient: age1sqssntfzzlhcgp0wuf9wmeavg0hmwmq349npsq8vaxj9sxey5s9ssc82sw
-          enc: |
+        - enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
             YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBXSERvcGNXdDlUb3NBUm40
             WW1mVlY5YlpxclBxT3htQ1orbHpxTnBUTEJNCkZaZnUzZUZNQmk0RmU2U2RkOUVI
@@ -11,7 +11,8 @@ sops:
             eDUxR1V0ZEFSYnZTYnYzakFydEliaFUKoa/gHecAy01vTk7I02KMGGPHZBql5K48
             hkLDjoWK9dkGRX8kqRd028cuMCQRenLpULEECWp6oV+evUdMf7wRtg==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2026-04-03T15:46:07Z"
-    mac: ENC[AES256_GCM,data:gh9Voy28Lo4G1qwQ7/WVAt/L3SAXIY5bs5fdCE0Oywi0ZV4YTJI5VCAcfxuE0Fc3DXdHF0/LORGjKa2l0yp5msMdBVpzI46FBiwYvU+w7EfEoEmhu0yMLf0SZmXkVLEq8u2uVFHGVbR1dOKcdFef+qTIGTlz4cE9VQ01xg/nh7g=,iv:fasXOAm2hjB4ULKT4vPOFnFpAcEgSeNvNM7Zrnk6MvM=,tag:1hWtpuTVdC3H8flA1m0Z0A==,type:str]
+          recipient: age1sqssntfzzlhcgp0wuf9wmeavg0hmwmq349npsq8vaxj9sxey5s9ssc82sw
+    lastmodified: "2026-06-26T20:44:20Z"
+    mac: ENC[AES256_GCM,data:GxcbV3hdk86tNZlzCcQTG0X206tpwxzkACO5KEF/T+ScvKIrbCYKVfQKmdEBR6/o1oSBP8R5kiNdsQu3ETpsVeb4GRtp3E/C41a7mOXtagvNo0id+kSmZFJNOgl1ki+8mPjZEO3m5IBnQgy1HtfGXe4Dbnk6iaDyyBl7ukJdXYY=,iv:djI/xYTI/WzQaihC2OZiry9swvkKB4LyrJglf2E71NE=,tag:d1Uzu7tVSQqkLMKZ3EZ/fA==,type:str]
     unencrypted_suffix: _unencrypted
-    version: 3.12.2
+    version: 3.13.1