From dce1beb8e2fe4ea47e5fe69a3bfe1bf6c8f6562a Mon Sep 17 00:00:00 2001
From: Kieran Klukas <me@dunkirk.sh>
Date: Thu, 27 Nov 2025 14:52:27 -0800
Subject: [PATCH] feat: add caddy and uptime kuma on prattle

---
 machines/prattle/default.nix |  37 ++++++++++++++++++++++++++++++++++-
 secrets/cloudflare.age       | Bin 0 -> 703 bytes
 secrets/secrets.nix          |   3 +++
 3 files changed, 39 insertions(+), 1 deletion(-)
 create mode 100644 secrets/cloudflare.age

diff --git a/machines/prattle/default.nix b/machines/prattle/default.nix
index 6b2266b..61de50f 100644
--- a/machines/prattle/default.nix
+++ b/machines/prattle/default.nix
@@ -99,6 +99,10 @@
       path = "/home/kierank/.wakatime.cfg";
       owner = "kierank";
     };
+    cloudflare = {
+      file = ../../secrets/cloudflare.age;
+      owner = "caddy";
+    };
   };
 
   environment.sessionVariables = {
@@ -152,7 +156,7 @@
 
   networking.firewall = {
     enable = true;
-    allowedTCPPorts = [ 22 ];
+    allowedTCPPorts = [ 22 80 443 ];
     logRefusedConnections = false;
     rejectPackets = true;
   };
@@ -162,6 +166,37 @@
     useRoutingFeatures = "client";
   };
 
+  services.caddy = {
+    enable = true;
+    package = pkgs.caddy.withPlugins {
+      plugins = [ "github.com/caddy-dns/cloudflare@v0.2.2" ];
+      hash = "sha256-Z8nPh4OI3/R1nn667ZC5VgE+Q9vDenaQ3QPKxmqPNkc=";
+    };
+    email = "me@dunkirk.sh";
+    globalConfig = ''
+      acme_dns cloudflare {env.CLOUDFLARE_API_TOKEN}
+    '';
+    virtualHosts."status.dunkirk.sh" = {
+      extraConfig = ''
+        tls {
+          dns cloudflare {env.CLOUDFLARE_API_TOKEN}
+        }
+        reverse_proxy localhost:3001
+      '';
+    };
+  };
+
+  systemd.services.caddy.serviceConfig = {
+    EnvironmentFile = config.age.secrets.cloudflare.path;
+  };
+
+  services.uptime-kuma = {
+    enable = true;
+    settings = {
+      PORT = "3001";
+    };
+  };
+
   boot.loader.systemd-boot.enable = true;
   boot.loader.efi.canTouchEfiVariables = true;
   boot.kernelParams = [ "net.ifnames=0" "console=ttyS0" ];
diff --git a/secrets/cloudflare.age b/secrets/cloudflare.age
new file mode 100644
index 0000000000000000000000000000000000000000..5145430d2061caeec86dcb29cc39eaf1fbd41f3c
GIT binary patch
literal 703
zcmYdHPt{G$OD?J`D9Oyv)5|YP*Do{V(zR14F3!*`Do#{zDNJ@Z2;}kz&os60_097N
zOwP(L_Q>!mbFDNl4J-^du`F^)H!3iTNVLfCa7i+Abk4{PC^IVxNY3#NG&Rc#@y|-H
zGD+d`%PR}b^onrFFD&x+P1iQjH%m0CN{*<i@Jo*>vds6ibTu|k$qhF03n?&94UUYm
z45=)v2nZ|<@OAQvjBtwN@()TZF?R7T_sMtlGpI5vEi|plODqZYEeotF_jl2+Dl!ak
zcB{w>jtt0%G%O6ubIc6M&av<<^$pJPF|ep|<q9**@bU}uD=2mKDmN}H_bae)ONy#0
zvaE`*DE3I#PBk}7b;-$#GOi49u`DZ1^v(6kD#>!oip(-D^D%Mr(dY6>_xH@OOtA>6
zNXn^9&JNEDc6AK*H#axVGfYXY3h>GZH3|++H*_v6bxHR&G_cGvGOaW$2sO(}4G9WP
z@hImCO*GFhOU-mPDzdC{OE32fb2Kb03@XnJ%8WGg&CgAD&QJ6=ElxKqP6><j$<0en
zF$_(rGOIFoF>nrc&I`5VN>0r8bS-qZ(64eW_1DiR%&PLpif}RZF3&d$OZG`Bi_8cz
zuQV++Gd0dA4lfOh^v+HX&nXSg3C#(PN-Zo%<VvY9$o6nI%JXr`Nh$X)%n7g3_bsR}
z^Vjz(@eJ|I_6{!dG|8*V3Qn;w2y;n_)Gl^Tb9AZlGB3<4uP8H!bmijG)zwunbayU_
z(l$1YNHp>>PV!4kODxIHb$7}yb}0@G^~o+uN%ATSttfN#F|*(bU9e!r6zc;|?}T3C
zDF32maB$n>>3#|io^luIF5!=Mc;XT9MNEa)Y}$V@*68g@Arlu$J)0hOeB*hwyIh7R
nD|7CduZYpwdU4&)x-Fe4r~fWg=P#Yj@Ho+N^4h-#9i<cj4Z!(q

literal 0
HcmV?d00001

diff --git a/secrets/secrets.nix b/secrets/secrets.nix
index bb56466..553e9ca 100644
--- a/secrets/secrets.nix
+++ b/secrets/secrets.nix
@@ -23,4 +23,7 @@ in
   "context7.age".publicKeys = [
     kierank
   ];
+  "cloudflare.age".publicKeys = [
+    kierank
+  ];
 }
-- 
2.51.2