wow

hosts/server/hikari/hako/services/caddy.nix

@@ -95,8 +95,8 @@ let
     '';
   };
 
-  # These were previously served by *.imnya.ng. Listing them explicitly lets
-  # stock Caddy obtain an individual certificate without a DNS challenge.
+  # Keep these explicit hosts for their existing per-host content. The
+  # wildcard host below handles any other one-level subdomain.
   staticHosts = [
     "26layer7beginner.imnya.ng"
     "alt.imnya.ng"
@@ -149,7 +149,20 @@ in
     enable = true;
     email = "imnyang@pm.me";
     openFirewall = true;
-    package = pkgs.caddy;
+    package = pkgs.caddy.withPlugins {
+      plugins = [
+        "github.com/caddy-dns/cloudflare@v0.2.2"
+        "github.com/aksdb/caddy-cgi/v2@v2.2.6"
+        "github.com/shift72/caddy-geo-ip@v0.6.0"
+        "github.com/lolPants/caddy-requestid@v1.1.2"
+        "github.com/WeidiDeng/caddy-cloudflare-ip@v0.0.0-20231130002422-f53b62aa13cb"
+        "github.com/caddyserver/ntlm-transport@v0.1.2"
+        "github.com/ueffel/caddy-brotli@v1.6.0"
+        "github.com/RussellLuo/caddy-ext/ratelimit@v0.3.0"
+        "github.com/neodyme-labs/user_agent_parse@v0.0.1"
+      ];
+      hash = "sha256-z9/LF2gws+H0pKL6F62QfklD0W8DKWCccnXLOOs3+jY=";
+    };
 
     globalConfig = ''
       admin unix//run/caddy/admin.socket
@@ -170,6 +183,15 @@ in
         }) staticHosts
       )
       // {
+        "*.imnya.ng".extraConfig = withErrors ''
+          tls {
+            dns cloudflare {env.CLOUDFLARE_API_TOKEN}
+          }
+
+          root * /var/static/{host}
+          file_server
+        '';
+
         "api.imnya.ng".extraConfig = reverseProxyWithHeaders "127.0.0.1:10118";
         "docs.imnya.ng".extraConfig = reverseProxy "100.70.1.1:3939";
         "panel.imnya.ng".extraConfig = reverseProxy "127.0.0.1:32981";
@@ -372,6 +394,7 @@ in
     requires = [ "mnt-static.mount" ];
     after = [ "mnt-static.mount" "systemd-tmpfiles-setup.service" ];
     serviceConfig = {
+      EnvironmentFile = "-/etc/caddy/cloudflare.env";
       RuntimeDirectory = "caddy";
       RuntimeDirectoryMode = "0755";
     };