Something went wrong. Try again.
My NixOS dotfiles
Something went wrong. Try again.
123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284{ email simon@renoux.dev metrics { per_host }}(logging) { log { output file /var/log/caddy/{args[0]}.log format console # level error }}rack.renoux.dev { respond "yup, this is a rack!"}celestenet.fantomitechno.dev { import logging cnet @not_local_net not client_ip 172.16.0.0/12 abort @not_local_net reverse_proxy 127.0.0.1:1099}# Communicationmatrix.fantomitechno.dev { import logging matrix reverse_proxy 127.0.0.1:2000}livekit.fantomitechno.dev { import logging livekit # for lk-jwt-service @lk-jwt-service path /sfu/get* /healthz* /get_token* route @lk-jwt-service { reverse_proxy 127.0.0.1:2001 } # for livekit reverse_proxy 127.0.0.1:2002}pds.fantomitechno.dev { import logging pds reverse_proxy 127.0.0.1:2010}# Storageknot.fantomitechno.dev { import logging knot reverse_proxy 127.0.0.1:4000}spindle.fantomitechno.dev { import logging spindle reverse_proxy 127.0.0.1:4001}git.fantomitechno.dev { import logging gitea @local_net client_ip 172.16.0.0/12 @not_local_net not client_ip 172.16.0.0/12 reverse_proxy @not_local_net 127.0.0.1:4006 { header_up X-Real-Ip {remote_host} } reverse_proxy @local_net 127.0.0.1:4005 { header_up X-Real-Ip {remote_host} }}hold.fantomitechno.dev { import logging hold reverse_proxy 127.0.0.1:4010}drive.renoux.dev, drive.s.renoux.dev { import logging cryptpad handle /cryptpad_websocket* { reverse_proxy 127.0.0.1:4021 } handle { reverse_proxy 127.0.0.1:44020 }}files.fantomitechno.dev { import logging copyparty reverse_proxy 127.0.0.1:4020}kiwix.fantomitechno.dev, kiwix.renoux.dev { import logging kiwix reverse_proxy 127.0.0.1:4030}wikipedia.renoux.dev { redir https://kiwix.renoux.dev/viewer#wikipedia_en_all_maxi_2026-02{uri}}photo.renoux.dev { import logging immich reverse_proxy 127.0.0.1:4040}vault.renoux.dev { import logging vaultwarden reverse_proxy 127.0.0.1:4050}pdf.fantom.home { import logging paperless @not_local_net not client_ip 172.16.0.0/12 abort @not_local_net reverse_proxy 127.0.0.1:4060 tls internal}notes.fantomitechno.dev { import logging affine reverse_proxy 127.0.0.1:4070}graph.fantom.home { import logging grafana @not_local_net not client_ip 172.16.0.0/12 abort @not_local_net reverse_proxy 127.0.0.1:3000 tls internal}fedi.fantomitechno.dev { root * /var/mastodon/public # gzip + zstd compression (replaces the gzip_* block) encode zstd gzip # HSTS on every response (nginx repeated this per location) header Strict-Transport-Security "max-age=63072000; includeSubDomains" # client_max_body_size 80m request_body { max_size 80MB } # --- Cache-Control headers --- @cache_week path /sw.js header @cache_week Cache-Control "public, max-age=604800, must-revalidate" @cache_month path /assets/* /avatars/* /emoji/* /headers/* /packs/* /shortcuts/* /sounds/* header @cache_month Cache-Control "public, max-age=2419200, must-revalidate" @cache_system path /system/* header @cache_system Cache-Control "public, max-age=2419200, immutable" # --- Streaming API (WebSockets are handled automatically) --- handle /api/v1/streaming* { reverse_proxy 127.0.0.1:2021 { flush_interval -1 # proxy_buffering off header_up X-Real-IP {remote_host} header_up -Proxy } } # --- Everything else: try static file, fall back to Rails --- handle { file_server { pass_thru # try_files $uri @proxy } reverse_proxy 127.0.0.1:2020 { header_up X-Real-IP {remote_host} header_up -Proxy } } # error_page 404 500 501 502 503 504 /500.html handle_errors { rewrite * /500.html file_server }}jellyfin.fantom.home { import logging jellyfin @not_local_net not client_ip 172.16.0.0/12 abort @not_local_net reverse_proxy 127.0.0.1:4080 tls internal}music.fantom.home { import logging jellyfin @not_local_net not client_ip 172.16.0.0/12 abort @not_local_net reverse_proxy 127.0.0.1:4085 tls internal}torrent.fantom.home { import logging qbittorrent @not_local_net not client_ip 172.16.0.0/12 abort @not_local_net reverse_proxy 127.0.0.1:4090 tls internal}flaresolver.fantom.home { import logging flaresolver @not_local_net not client_ip 172.16.0.0/12 abort @not_local_net reverse_proxy 127.0.0.1:4091 tls internal}prowlarr.fantom.home { import logging prowlarr @not_local_net not client_ip 172.16.0.0/12 abort @not_local_net reverse_proxy 127.0.0.1:4092 tls internal}jackett.fantom.home { import logging jackett @not_local_net not client_ip 172.16.0.0/12 abort @not_local_net reverse_proxy 127.0.0.1:4093 tls internal}sonarr.fantom.home { import logging sonarr @not_local_net not client_ip 172.16.0.0/12 abort @not_local_net reverse_proxy 127.0.0.1:4094 tls internal}radarr.fantom.home { import logging radarr @not_local_net not client_ip 172.16.0.0/12 abort @not_local_net reverse_proxy 127.0.0.1:4095 tls internal}bazarr.fantom.home { import logging bazarr @not_local_net not client_ip 172.16.0.0/12 abort @not_local_net reverse_proxy 127.0.0.1:4096 tls internal}