bifrost: move public facing reverse proxies to bifrost

hosts/bifrost/network/wireguard.nix

@@ -3,6 +3,7 @@ let
   wireguard-peers = import ../../shared/wireguard-peers.nix;
 in
 {
+  nodeconfig.facts.wireguard-ip = "10.10.10.1";
   sops.secrets = {
     "wireguard/bifrost/pk" = {
       mode = "400";

hosts/bifrost/services/apps/acomputer.lol.nix

@@ -1,12 +1,10 @@
 _:
 let
-  inherit (import ../../../shared/caddy-helpers.nix) logFormat;
   domainName = "acomputer.lol";
 in
 {
   services = {
     caddy.virtualHosts."${domainName}" = {
-      inherit logFormat;
       extraConfig = ''
         handle /.well-known/matrix/server {
           header Content-Type application/json

hosts/bifrost/services/apps/adtya.xyz.nix

@@ -1,13 +1,11 @@
 { inputs, pkgs, ... }:
 let
-  inherit (import ../../../shared/caddy-helpers.nix) logFormat;
   domainName = "adtya.xyz";
 in
 {
   services = {
     caddy.virtualHosts."${domainName}" = {
       serverAliases = [ "www.${domainName}" ];
-      inherit logFormat;
       extraConfig = ''
         handle {
           root * ${inputs.adtyaxyz.packages.${pkgs.system}.default}/share/web

hosts/bifrost/services/apps/default.nix

@@ -0,0 +1,11 @@
+_: {
+  imports = [
+    ./adtya.xyz.nix
+    ./acomputer.lol.nix
+    ./dendrite.nix
+    ./forgejo.nix
+    ./ntfy.nix
+    ./proofs.nix
+    ./wiki.nix
+  ];
+}

hosts/bifrost/services/apps/dendrite.nix

@@ -1,12 +1,10 @@
 _:
 let
-  inherit (import ../../../shared/caddy-helpers.nix) logFormat;
   domainName = "matrix.acomputer.lol";
 in
 {
   services = {
     caddy.virtualHosts."${domainName}" = {
-      inherit logFormat;
       extraConfig = ''
         reverse_proxy 10.10.10.13:8008
       '';

hosts/bifrost/services/apps/forgejo.nix

@@ -1,12 +1,10 @@
 _:
 let
-  inherit (import ../../../shared/caddy-helpers.nix) logFormat;
   domainName = "forge.acomputer.lol";
 in
 {
   services = {
     caddy.virtualHosts."${domainName}" = {
-      inherit logFormat;
       extraConfig = ''
         reverse_proxy 10.10.10.13:3000
       '';

hosts/bifrost/services/apps/ntfy.nix

@@ -0,0 +1,13 @@
+_:
+let
+  domainName = "ntfy.acomputer.lol";
+in
+{
+  services = {
+    caddy.virtualHosts."${domainName}" = {
+      extraConfig = ''
+        reverse_proxy 10.10.10.13:8080
+      '';
+    };
+  };
+}

hosts/bifrost/services/apps/proofs.nix

@@ -0,0 +1,13 @@
+_:
+let
+  domainName = "proofs.adtya.xyz";
+in
+{
+  services = {
+    caddy.virtualHosts."${domainName}" = {
+      extraConfig = ''
+        redir https://keyoxide.org/hkp/51E4F5AB1B82BE45B4229CC243A5E25AA5A27849
+      '';
+    };
+  };
+}

hosts/bifrost/services/apps/wiki.nix

@@ -1,12 +1,10 @@
 { inputs, pkgs, ... }:
 let
-  inherit (import ../../../shared/caddy-helpers.nix) logFormat;
   domainName = "wiki.adtya.xyz";
 in
 {
   services = {
     caddy.virtualHosts."${domainName}" = {
-      inherit logFormat;
       extraConfig = ''
         handle {
           root * ${inputs.wiki.packages.${pkgs.system}.default}/share/web

hosts/bifrost/services/default.nix

@@ -1,5 +1,9 @@
 _: {
   imports = [
     ./ssh.nix
+
+    ../../shared/caddy.nix
+
+    ./apps
   ];
 }

hosts/rico0/services/apps/default.nix

@@ -1,13 +1,5 @@
 _: {
   imports = [
-    ./acomputer.lol.nix
-    ./adtya.xyz.nix
-    ./dendrite.nix
-    ./forgejo.nix
-    ./ntfy.nix
-    ./proofs.nix
-    ./wiki.nix
-    ./dendrite.nix
     ../../../shared/prometheus-exporters.nix
     ../../../shared/promtail.nix
   ];

hosts/rico0/services/apps/ntfy.nix

@@ -1,18 +0,0 @@
-_:
-let
-  inherit (import ../../../shared/caddy-helpers.nix) logFormat;
-  domainName = "ntfy.acomputer.lol";
-in
-{
-  services = {
-    caddy.virtualHosts = {
-
-      "${domainName}" = {
-        inherit logFormat;
-        extraConfig = ''
-          reverse_proxy 10.10.10.13:8080
-        '';
-      };
-    };
-  };
-}

hosts/rico0/services/apps/proofs.nix

@@ -1,17 +0,0 @@
-_:
-let
-  inherit (import ../../../shared/caddy-helpers.nix) logFormat;
-  domainName = "proofs.adtya.xyz";
-in
-{
-  services = {
-    caddy.virtualHosts = {
-      "${domainName}" = {
-        inherit logFormat;
-        extraConfig = ''
-          redir https://keyoxide.org/hkp/51E4F5AB1B82BE45B4229CC243A5E25AA5A27849
-        '';
-      };
-    };
-  };
-}

hosts/shared/caddy-helpers.nix

@@ -1,7 +0,0 @@
-{
-  logFormat = ''
-    output stderr
-    format json
-    level ERROR
-  '';
-}

hosts/shared/caddy.nix

@@ -1,8 +1,4 @@
-{ config, inputs, pkgs, ... }:
-let
-  inherit (import ./caddy-helpers.nix) logFormat;
-in
-{
+{ config, inputs, pkgs, ... }: {
   sops = {
     secrets = {
       "caddy/env_file" = {
@@ -17,14 +13,12 @@ in
     package = inputs.caddy.packages.${pkgs.system}.caddy;
     email = "admin@acomputer.lol";
     globalConfig = ''
+      admin ${config.nodeconfig.facts.wireguard-ip}:2019
       acme_dns hetzner {env.HETZNER_ACCESS_TOKEN}
       servers {
-        trusted_proxies static private_ranges 10.10.10.0/24
-        client_ip_headers X-Forwarded-For X-Real-IP
         metrics
       }
     '';
-    inherit logFormat;
   };
   systemd.services.caddy.serviceConfig.EnvironmentFile = config.sops.secrets."caddy/env_file".path;
   networking.firewall.allowedTCPPorts = [ 80 443 ];

modules/default.nix

@@ -1,5 +1,6 @@
 _: {
   imports = [
+    ./facts.nix
     ./general.nix
     ./nix.nix
     ./pi.nix

modules/facts.nix

@@ -0,0 +1,12 @@
+{ lib, ... }: {
+  options.nodeconfig = {
+    facts = {
+      wireguard-ip = lib.mkOption {
+        type = lib.types.str;
+        default = null;
+        example = "10.0.0.1";
+        description = "Wireguard IP of the node";
+      };
+    };
+  };
+}