run caddy on racksrv asw

sys/machines/rackserv/caddy.nix

@@ -0,0 +1,43 @@
+{
+  vars,
+  config,
+  ...
+}: let
+  inherit (vars) domain;
+  hopper = "10.0.0.2";
+in {
+  networking.firewall.allowedTCPPorts = [80 443];
+
+  security.acme = {
+    acceptTerms = true;
+    defaults.email = "xunuwu@gmail.com";
+    certs = {
+      "${domain}" = {
+        domain = "${domain}";
+        extraDomainNames = ["*.${domain}"];
+        dnsProvider = "cloudflare";
+        reloadServices = ["caddy.service"];
+        credentialFiles.CF_DNS_API_TOKEN_FILE = config.sops.secrets.cloudflare.path;
+      };
+    };
+  };
+
+  services.caddy = {
+    enable = true;
+    virtualHosts = {
+      misc = {
+        hostName = "${domain}";
+        serverAliases = ["*.${domain}"];
+        useACMEHost = domain;
+        extraConfig = ''
+          reverse_proxy ${hopper}
+        '';
+      };
+      other = {
+        extraConfig = ''
+          respond 404
+        '';
+      };
+    };
+  };
+}

sys/machines/rackserv/default.nix

@@ -12,6 +12,7 @@
       ./fail2ban.nix
       ./wireguard-server.nix
       ./backups.nix
+      ./caddy.nix
     ]
     ++ (map (x: systemProfiles + x) [
       /secrets/default.nix

sys/machines/rackserv/wireguard-server.nix

@@ -7,7 +7,7 @@
   networking.firewall = let
     forwardPorts = {
       "10.0.0.2" =
-        [24001 24002 24003 443 80]
+        [24001 24002 24003]
         |> map (n: {
           protocols = ["tcp"];
           port = n;