nixos-config/machines/gitea/caddy.nix

# { caddy-with-plugins, ... }:
{
  pkgs,
  config,
  inputs,
  ...
}:
{
  services.caddy = {
    enable = true;
    package = inputs.caddy-with-plugins.packages.${pkgs.system}.caddy-with-cloudflare;

    email = "erwin@datarift.nl";

    virtualHosts = {
      "git.datarift.nl" = {
        extraConfig = ''
          @local {
            remote_ip 10.0.0.0/24
          }

          handle @local {
            reverse_proxy 127.0.0.1:3000
          }

          handle {
            error "Nope." 403
          }

          tls {
            dns cloudflare {env.CF_API_TOKEN}
          }
        '';
      };
    };
  };

  networking.firewall.allowedTCPPorts = [
    80
    443
  ];

  systemd.services.caddy.serviceConfig.EnvironmentFile = [ config.sops.secrets.caddy-env.path ];
}