Caddy on NixOS

configuration.nix

{ config, pkgs, options, ... }:
let
  baseConfig = {
    allowUnfree = true;
  };

  unstable = import <nixos-unstable> { config = baseConfig; };
in
{
  imports = [
    ./hardware-configuration.nix
    ./firewall.nix
    ./webserver.nix
  ];

  # Select internationalisation properties.
  console = {
    keyMap = "us";
  };

  i18n = {
    defaultLocale = "en_US.UTF-8";
  };

  boot.cleanTmpDir = true;

  networking.hostName = "uzura";

  services.openssh.enable = true;

  users.users.root.openssh.authorizedKeys.keys = [
    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMggSI757ny3dE/2d6RUpQjkZkPEyEvQCEMXVhwngvaJ roberto@pulsedemon" 
  ];

  nix = {
    # automate `nix-store --optimise`
    autoOptimiseStore = true;

    # automate garbage collection
    gc = {
      automatic = true;
      dates = "weekly";
      options = "--delete-older-than 7d";
    };
  };

  nixpkgs = {
    config = baseConfig // {
      packageOverrides = pkgs: {
      };
    };
    overlays = [
      (
        post: pre: {
        }
      )
    ];
  };
}

firewall.nix

{ config, lib, pkgs, ... }:

{
  networking.firewall = {
    allowPing = true;
    # allowed TCP range
    allowedTCPPorts = [ 80 443 ];
  };
}

webserver.nix

{config, pkgs, ...}:
let
  caddyDir = "/var/lib/caddy";

  myPHP = pkgs.php.buildEnv {
    extensions = { all, ... }: with all; [ opcache ];
    extraConfig = "memory_limit=128M";
  };
in
{
  services.caddy = {
    enable = true;
    email = "roberto.diremigio@hey.com";
    config = ''
    {
      storage file_system {
        root ${caddyDir}
      }
    }

    uzura.weddinginitalia.no {
      root * /srv/www/uzura.weddinginitalia.no

      encode gzip zstd

      file_server

      header / {
        X-Content-Type-Options "nosniff"
        X-Frame-Options "sameorigin"
        Referrer-Policy "no-referrer-when-downgrade"
        X-UA-Compatible "IE=edge,chrome=1"
        X-XSS-Protection "1; mode=block"
        Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
      }
    }

    www.uzura.weddinginitalia.no {
      redir https://uzura.weddinginitalia.no{uri}
    }
    '';
    adapter = "caddyfile";
  };

  services.phpfpm.pools = {
    uzura = {
      user = "caddy";
      group = "caddy";
      phpPackage = myPHP;
      #settings = {
      #  "pm" = "dynamic";
      #};
    };
  };

  users.users.caddy = {
    group = "caddy";
    uid = config.ids.uids.caddy;
    home = caddyDir;
    createHome = true;
    extraGroups = [ "users" ];
  };

  users.groups.caddy.gid = config.ids.uids.caddy;
}