1 files changed, 49 insertions, 0 deletions
diff --git a/modules/caddy.nix b/modules/caddy.nix
new file mode 100644
index 0000000..c2c41e4
--- /dev/null
+++ b/modules/caddy.nix
@@ -0,0 +1,49 @@
+{ ... }:
+
+# Caddy reverse proxy with automatic HTTPS (Let's Encrypt).
+# All app ports are bound to 127.0.0.1; only Caddy listens on 80/443.
+{
+  services.caddy = {
+    enable = true;
+    email = "me@karanj.com";
+
+    virtualHosts = {
+
+      # AdGuard Home web UI
+      "dns.karanj.com" = {
+        extraConfig = ''
+          reverse_proxy 127.0.0.1:3000
+        '';
+      };
+
+      # Miniflux RSS reader
+      "rss.karanj.com" = {
+        extraConfig = ''
+          reverse_proxy 127.0.0.1:8080
+        '';
+      };
+
+      # Actual Budget
+      "budget.karanj.com" = {
+        extraConfig = ''
+          reverse_proxy 127.0.0.1:5006
+        '';
+      };
+
+      # cgit - public read-only git viewer + smart HTTP for git clone/pull
+      "git.karanj.com" = {
+        extraConfig = ''
+          # Smart HTTP git (clone/pull only - no push exposed)
+          handle /git/* {
+            reverse_proxy 127.0.0.1:8085
+          }
+          # cgit web UI
+          handle {
+            reverse_proxy 127.0.0.1:8086
+          }
+        '';
+      };
+
+    };
+  };
+}