caddy-deps.nix

[
  {
    goPackagePath = "github.com/caddyserver/dnsproviders/cloudflare";
    fetch = {
      type = "git";
      url = "https://github.com/caddyserver/dnsproviders";
      rev = "272452b36c2f962599ed59085829141bfc742d87";
      sha256 = "163cpzam39zdc6bv7iz1a4w4lwayrq3krbfr6lncnsrqqknp5pvn"; # This should be the right sha256
    };
  }
]

Caddyfile

http://example.com {
  root /srv/http
  tls {
    dns cloudflare
  }
}

configuration.nix

{ config, pkgs, ... }:

let 
  caddyCloudflare = pkgs.caddy.overrideDerivation (oldAttrs: {
    name = "caddy-cloudflare-${oldAttrs.version}";
    preConfigure = ''
        substituteInPlace ./caddy/caddymain/run.go \
        --replace '// This is where other plugins get plugged in (imported)' \
        '_ "github.com/caddyserver/dnsproviders/cloudflare"'
    '';
    goDeps = ./caddy-deps.nix;
  });
in
{
    caddy = {
      enable = true;
      ca = "https://acme-staging-v02.api.letsencrypt.org/directory"; # Use staging cert api
      config = builtins.readFile ./Caddyfile;
      package = caddyCloudflare;
    };
}