dotfiles/modules/nixos/services/caddy/caddyCeres/default.nix

{ flake, ... }:
let
  inherit (flake.config.services) instances;
  inherit (flake.config.machines) devices;

  domain0 = instances.web.domains.url0;
  service = instances.caddy;
  nextcloud = instances.nextcloud;
  opencloud = instances.opencloud;
in
{
  services.caddy = {
    enable = true;
    virtualHosts = {
      "${domain0}" = {
        extraConfig = ''
          tls /var/lib/acme/${domain0}/fullchain.pem /var/lib/acme/${domain0}/key.pem
          encode zstd gzip
        '';
      };
      "${nextcloud.domains.url0}" = {
        extraConfig = ''
          reverse_proxy http://${devices.eris.ip.address0}:${builtins.toString service.ports.port3}
          tls ${nextcloud.ssl.cert} ${nextcloud.ssl.key}
        '';
      };
      "${opencloud.domains.url0}" = {
        extraConfig = ''
          reverse_proxy http://${devices.eris.ip.address0}:${builtins.toString service.ports.port4}
          tls ${opencloud.ssl.cert} ${opencloud.ssl.key}
        '';
      };
    };
  };
  users.users.${service.name}.extraGroups = [
    "acme"
    "mastodon"
    "firefly-iii"
  ];

  networking = {
    firewall = {
      allowedTCPPorts = [
        service.ports.port0
        service.ports.port1
      ];
    };
  };
}