From 0d0788cd4ee378fba19e47a2c5d5527c196b65e0 Mon Sep 17 00:00:00 2001
From: Karan Jayachandra <karan.jayachandra@nxp.com>
Date: Fri, 17 Jul 2026 14:34:18 +0200
Subject: Initial commit

---
 modules/caddy.nix | 49 +++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 49 insertions(+)
 create mode 100644 modules/caddy.nix

(limited to 'modules/caddy.nix')

diff --git a/modules/caddy.nix b/modules/caddy.nix
new file mode 100644
index 0000000..c2c41e4
--- /dev/null
+++ b/modules/caddy.nix
@@ -0,0 +1,49 @@
+{ ... }:
+
+# Caddy reverse proxy with automatic HTTPS (Let's Encrypt).
+# All app ports are bound to 127.0.0.1; only Caddy listens on 80/443.
+{
+  services.caddy = {
+    enable = true;
+    email = "me@karanj.com";
+
+    virtualHosts = {
+
+      # AdGuard Home web UI
+      "dns.karanj.com" = {
+        extraConfig = ''
+          reverse_proxy 127.0.0.1:3000
+        '';
+      };
+
+      # Miniflux RSS reader
+      "rss.karanj.com" = {
+        extraConfig = ''
+          reverse_proxy 127.0.0.1:8080
+        '';
+      };
+
+      # Actual Budget
+      "budget.karanj.com" = {
+        extraConfig = ''
+          reverse_proxy 127.0.0.1:5006
+        '';
+      };
+
+      # cgit - public read-only git viewer + smart HTTP for git clone/pull
+      "git.karanj.com" = {
+        extraConfig = ''
+          # Smart HTTP git (clone/pull only - no push exposed)
+          handle /git/* {
+            reverse_proxy 127.0.0.1:8085
+          }
+          # cgit web UI
+          handle {
+            reverse_proxy 127.0.0.1:8086
+          }
+        '';
+      };
+
+    };
+  };
+}
-- 
cgit v1.3.1