mikl
220d1f651c
- remove k3s.nix (1.3GB overhead unjustified for single-node) - add docker.nix (docker + arion CLI, mikl in docker group) - add caddy.nix (edge proxy, TLS via ACME staging, host-based routing) - add syncthing.nix (sync daemon + strelaysrv via systemd, /srv/syncthing) - add arion-compose.nix (forgejo first, others stubbed as TODO) - add arion flake input + nixos module - default.nix: wire up arion project as systemd service (serviceName=heather) Architecture: Caddy (host) terminates TLS, routes to host services (syncthing) and docker containers (arion, 127.0.0.1:PORT). Named volumes everywhere except silverbullet (bind /srv/syncthing/herbarium).
85 lines
2.7 KiB
Nix
85 lines
2.7 KiB
Nix
# heather — Caddy как единый edge (TLS termination, reverse proxy).
|
|
#
|
|
# Заменяет Traefik (k3s built-in, отключён) и старые Caddy на iscg-dev/jul11.
|
|
# Паттерн как на iscg-dev: system Caddy, конфиг декларативно в nix.
|
|
#
|
|
# Caddy терминирует TLS на :80/:443 и роутит по Host на:
|
|
# - host-сервисы (syncthing GUI на localhost:8384) — напрямую
|
|
# - docker-контейнеры (forgejo на localhost:3030 и т.д.) — проброшенные порты
|
|
#
|
|
# ACME: пока staging (чтобы не забанили Let's Encrypt пока DNS не переведён на
|
|
# heather). Когда A-записи iscg.dev → 51.250.45.111 — переключим на production
|
|
# (убрать acme_ca, Caddy использует production LE по умолчанию).
|
|
|
|
{ config, pkgs, lib, ... }:
|
|
|
|
let
|
|
# caddy/basic-auth под паролем. hash сгенерить:
|
|
# caddy hash-password
|
|
# Пока заглушка — syncthing GUI имеет свой пароль + Caddy basicauth сверху.
|
|
syncBasicAuth = ''
|
|
basicauth {
|
|
mikl $2a$14$bQ5MVsSFUuIJjHETVXzISOTy5SpLxRUlH6krxpzLH1.E0imi37Zb.
|
|
}
|
|
'';
|
|
|
|
in {
|
|
services.caddy = {
|
|
enable = true;
|
|
# Staging ACME пока DNS не переведён на heather (см. комментарий выше).
|
|
# Для production: убрать acme_ca, Caddy сам использует Let's Encrypt.
|
|
acmeCA = "https://acme-staging-v02.api.letsencrypt.org/directory";
|
|
email = "mikl@iscg.dev";
|
|
|
|
virtualHosts = {
|
|
# --- Syncthing GUI (host-сервис) ---
|
|
"sync.iscg.dev".extraConfig = syncBasicAuth + ''
|
|
reverse_proxy 127.0.0.1:8384
|
|
'';
|
|
|
|
# --- Контейнеры (arion, см. arion-compose.nix) ---
|
|
# Forgejo
|
|
"git.iscg.dev".extraConfig = ''
|
|
reverse_proxy 127.0.0.1:3030
|
|
'';
|
|
|
|
# Matrix tuwunel (homeserver)
|
|
"iscg.dev".extraConfig = ''
|
|
reverse_proxy 127.0.0.1:8008
|
|
encode zstd gzip
|
|
'';
|
|
|
|
# Matrix federation
|
|
"iscg.dev:8448".extraConfig = ''
|
|
reverse_proxy 127.0.0.1:8008
|
|
'';
|
|
|
|
# tuwunel-admin
|
|
"admin.iscg.dev".extraConfig = ''
|
|
reverse_proxy 127.0.0.1:8009
|
|
'';
|
|
|
|
# Cinny (matrix web client)
|
|
"chat.iscg.dev".extraConfig = ''
|
|
reverse_proxy 127.0.0.1:8080
|
|
encode zstd gzip
|
|
'';
|
|
|
|
# Jitsi Meet
|
|
"jitsi.iscg.dev".extraConfig = ''
|
|
reverse_proxy 127.0.0.1:8000
|
|
encode zstd gzip
|
|
'';
|
|
|
|
# Teable
|
|
"teable.iscg.dev".extraConfig = ''
|
|
reverse_proxy 127.0.0.1:2345
|
|
'';
|
|
|
|
# Silverbullet
|
|
"note.iscg.dev".extraConfig = ''
|
|
reverse_proxy 127.0.0.1:3001
|
|
'';
|
|
};
|
|
};
|
|
}
|