Run `nix build .#caddy` against this to generate a Caddy binary using xcaddy with whatever plugins you've specified built in.

flake.nix

{
  inputs.nixpkgs.url = "github:nixos/nixpkgs?ref=nixos-unstable";

  outputs = inputs@{ flake-parts, ... }:
  flake-parts.lib.mkFlake { inherit inputs; } {
    systems = ["x86_64-linux"];
      perSystem = { pkgs, ... }: {
        packages.caddy = pkgs.callPackage ./pkg.nix {};
      };
    };
}

pkg.nix

{ buildGoModule, stdenv, lib, git, go, xcaddy }:
let
  plugins = [ "github.com/caddyserver/ntlm-transport@v0.1.1" ];
  src = stdenv.mkDerivation {
    pname = "caddy-buildenv";
    version = "latest";
    dontUnpack = true;

    nativeBuildInputs = [ git go xcaddy ];

    configurePhase = ''
      export GOCACHE=$TMPDIR/go-cache
      export GOPATH="$TMPDIR/go"
      
      # Needed so we can use buildGoModule to create the binary later.
      export XCADDY_SKIP_BUILD=1
    '';

    buildPhase =
      let
        pluginArgs = lib.concatMapStringsSep " " (plugin: "--with ${plugin}") plugins;
      in
      ''
        runHook preBuild
        ${xcaddy}/bin/xcaddy build latest ${pluginArgs}
        (cd buildenv_* && go mod vendor)
        runHook postBuild
      '';

    installPhase = ''
      runHook preInstall
      mkdir -p $out
      cp -r buildenv_*/* $out/
      runHook postInstall
    '';

    outputHashMode = "recursive";
    outputHashAlgo = "sha256";

    # Update this when you change your plugin set (including version changes)
    outputHash = "sha256-3spjFss60N8fMlluTO2rlz68iP9g48n5mqUBfgvugdo=";
  };
in
  buildGoModule {
    name = "caddy";
    inherit src;
    vendorHash = null; # We already vendor our dependencies in src, so we don't need to specify this.
    doCheck = false;
  }