dotfiles/modules/nixos/homelab/caddy/default.nix

{ flake, ... }:
let
  inherit (flake.config.services) instances;
  serviceCfg = instances.caddy;

  importList =
    let
      content = builtins.readDir ./.;
      dirContent = builtins.filter (n: content.${n} == "directory") (builtins.attrNames content);
    in
    map (name: ./. + "/${name}") dirContent;

in
{
  imports = importList;

  services.caddy = {
    enable = true;
  };

  systemd.tmpfiles.rules = [
    "d /run/secrets/caddy 755 caddy caddy -"
    "d /var/log/caddy 755 caddy caddy -"
  ];

  networking = {
    firewall = {
      allowedTCPPorts = [
        serviceCfg.ports.port0 # 80
        serviceCfg.ports.port1 # 443
      ];
    };
  };
}