modules/nixos/services/cloudflared.nix


1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41

{
  config,
  lib,
  secretsDir,
  ...
}: let
  cfg = config.server.services.cloudflared;
  inherit (lib) mkEnableOption mkIf;
in {
  options.server.services.cloudflared = {
    enable = mkEnableOption "cloudflared";
  };

  config = mkIf cfg.enable {
    age.secrets.cloudflaredCreds = {
      file = secretsDir + "/cloudflaredCreds.age";
      mode = "400";
      owner = "cloudflared";
      group = "cloudflared";
    };

    services.cloudflared = {
      enable = true;
      tunnels = {
        "${config.networking.hostName}-nginx" = {
          default = "http_status:404";

          ingress = let
            inherit (config.services) nginx;
          in
            lib.genAttrs
            (builtins.attrNames nginx.virtualHosts)
            (_: {service = "http://localhost:${builtins.toString nginx.defaultHTTPListenPort}";});

          originRequest.noTLSVerify = true;
          credentialsFile = config.age.secrets.cloudflaredCreds.path;
        };
      };
    };
  };
}