105 lines
4.2 KiB
Nix
105 lines
4.2 KiB
Nix
# Internal reverse proxy for the gateway: Caddy terminates TLS for
|
|
# <service>.<site><siteId>.<proxy.domain> (e.g. omada.cnx1.cnx.network) and
|
|
# forwards to backends by their internal address. The cert is a real Let's
|
|
# Encrypt wildcard (*.<site><siteId>.<domain>) obtained via ACME DNS-01
|
|
# against proxy.acme.nameserver with a gateway-scoped TSIG key, so browsers
|
|
# trust it without any CA install; the names only *resolve* internally —
|
|
# Blocky answers them with the router's LAN address, the public zone never
|
|
# carries them.
|
|
#
|
|
# The TSIG secret is the shared dns-acme-<hostname>-secret generator
|
|
# (acme-secret.nix, declared here via default.nix); the nameserver machine
|
|
# must declare the same generator and load the key (this fleet: ns1).
|
|
{ settings }:
|
|
{ config, lib, ... }:
|
|
let
|
|
cfg = settings;
|
|
hostname = config.networking.hostName;
|
|
tsigKey = "acme_${lib.replaceStrings [ "-" ] [ "_" ] hostname}";
|
|
certName = "${cfg.site}${toString cfg.siteId}.${cfg.proxy.domain}";
|
|
nameserver = "${cfg.proxy.acme.nameserver}:53";
|
|
in
|
|
{
|
|
config = lib.mkIf cfg.proxy.enable {
|
|
assertions = [
|
|
{
|
|
assertion = lib.all (v: cfg.vlans ? ${v}) cfg.proxy.allowVlans;
|
|
message = "router: proxy.allowVlans must name VLANs defined in vlans.";
|
|
}
|
|
];
|
|
|
|
# Render the shared per-gateway TSIG secret into a lego rfc2136 env file,
|
|
# scoped on the nameserver to _acme-challenge.<site><siteId> TXT records.
|
|
clan.core.vars.generators."dns-acme-${hostname}-rfc2136" = {
|
|
files."rfc2136.env".secret = true; # root-owned; systemd reads it as root
|
|
dependencies = [ "dns-acme-${hostname}-secret" ];
|
|
script = ''
|
|
printf 'RFC2136_NAMESERVER=${nameserver}\nRFC2136_TSIG_ALGORITHM=hmac-sha256.\nRFC2136_TSIG_KEY=${tsigKey}\nRFC2136_TSIG_SECRET=%s\n' \
|
|
"$(cat "$in"/dns-acme-${hostname}-secret/secret)" > "$out"/rfc2136.env
|
|
'';
|
|
};
|
|
|
|
security.acme = {
|
|
acceptTerms = true;
|
|
defaults.email = cfg.proxy.acme.email;
|
|
# One wildcard for every proxied service; DNS-01, so issuance works
|
|
# behind PPPoE with no inbound reachability at all.
|
|
certs.${certName} = {
|
|
domain = "*.${certName}";
|
|
dnsProvider = "rfc2136";
|
|
environmentFile =
|
|
config.clan.core.vars.generators."dns-acme-${hostname}-rfc2136".files."rfc2136.env".path;
|
|
# Only that nameserver accepts this key's UPDATE; check propagation
|
|
# against it directly rather than a public resolver.
|
|
dnsResolver = nameserver;
|
|
# Caddy reads the cert from explicit file paths (tls directive below),
|
|
# so it won't notice a renewal on its own.
|
|
reloadServices = [ "caddy.service" ];
|
|
};
|
|
};
|
|
|
|
# The lego-issued cert is owned group=acme; Caddy needs to read the key.
|
|
users.users.caddy.extraGroups = [ "acme" ];
|
|
|
|
# The explicit `tls cert key` points Caddy at the wildcard cert and disables
|
|
# its automatic ACME, so no extra issuance happens.
|
|
services.caddy = {
|
|
enable = true;
|
|
virtualHosts = lib.mapAttrs' (
|
|
name: svc:
|
|
lib.nameValuePair "${name}.${certName}" {
|
|
extraConfig = ''
|
|
tls /var/lib/acme/${certName}/cert.pem /var/lib/acme/${certName}/key.pem
|
|
${
|
|
if svc.insecureSkipVerify then
|
|
''
|
|
reverse_proxy ${svc.backend} {
|
|
transport http {
|
|
tls_insecure_skip_verify
|
|
}
|
|
}''
|
|
else
|
|
"reverse_proxy ${svc.backend}"
|
|
}
|
|
'';
|
|
}
|
|
) cfg.proxy.services;
|
|
};
|
|
|
|
# Blocky answers <anything>.<site><siteId>.cnx.network (customDNS covers
|
|
# subdomains) with the router's LAN address — clients on any allowed VLAN
|
|
# reach that address through the router's input path.
|
|
services.blocky.settings.customDNS.mapping.${certName} = cfg.vlans.lan.address;
|
|
|
|
# 443 serves the proxy; 80 only carries Caddy's automatic HTTP->HTTPS
|
|
# redirect. mgmt is already a trusted interface; listed anyway so shrinking
|
|
# trustedInterfaces later doesn't silently break the proxy.
|
|
networking.firewall.interfaces = lib.genAttrs (map (v: "vlan-${v}") cfg.proxy.allowVlans) (_: {
|
|
allowedTCPPorts = [
|
|
80
|
|
443
|
|
];
|
|
});
|
|
};
|
|
}
|