Added hetzner server configs

servers/hetzner/modules/services/caddy.nix

@@ -0,0 +1,248 @@
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}: let
+  domain = "severijnse.eu";
+  antiScrape = ''
+    @bad_bot {
+      header_regexp User-Agent "(?i)(scrapy|cpython-requests|python-requests|curl|wget|go-http-client|ltx71|petalbot|bytespider|dotbot|ahrefsbot|semrushbot|mj12bot|dataforseo|facebookexternalhit|claudebot|anthropic-ai|perplexity|gptbot|chatgpt-user|omnisci|imgproxy|ccbot|exabot|360spider|baiduspider|sogou|duckduckgo|amazonbot|cohere-ai|diffbot|imagesiftbot).*"
+    }
+    respond @bad_bot "" 444
+    header {
+      X-Robots-Tag "noindex, nofollow, noai, noimageai"
+    }
+  '';
+in {
+  services.caddy = {
+    enable = true;
+    group = "caddy";
+    dataDir = "/var/lib/caddy";
+    logDir = "/var/log/caddy";
+    globalConfig = ''
+      email jory@severijnse.eu
+      servers {
+        trusted_proxies static private_ranges
+      }
+    '';
+    # Global Caddyfile snippets (shared across all virtual hosts).
+    extraConfig = ''
+      (admin_gate) {
+        @notvpn not remote_ip 10.8.0.0/24
+        respond @notvpn "Forbidden" 403
+      }
+      # Security headers applied to every response of every site that
+      # imports this snippet (covers all current and future hosts).
+      # For proxied hosts whose upstream sets its own copies, strip them
+      # with `header_down` inside the reverse_proxy block instead.
+      (security_headers) {
+        header {
+          X-Content-Type-Options "nosniff"
+          X-XSS-Protection "0"
+          X-Frame-Options "SAMEORIGIN"
+        }
+      }
+      (csp) {
+        header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob:; font-src 'self' data:; object-src 'none'; base-uri 'self'; frame-ancestors 'self'; form-action 'self'; connect-src 'self' wss: ws:"
+      }
+    '';
+    virtualHosts = {
+      "severijnse.eu" = {
+        extraConfig = ''
+          import security_headers
+          import csp
+          ${antiScrape}
+          @logo path /logo.svg
+          handle @logo {
+            root * /srv
+            file_server
+            header Content-Type image/svg+xml
+            header Cache-Control "public, immutable, max-age=31536000"
+            header X-Content-Type-Options nosniff
+          }
+          handle {
+            redir https://jory.severijnse.eu{uri} permanent
+          }
+        '';
+      };
+
+      "www.severijnse.eu" = {
+        extraConfig = ''
+          import security_headers
+          import csp
+          ${antiScrape}
+          redir https://jory.severijnse.eu{uri} permanent
+        '';
+      };
+
+      "jory.severijnse.eu" = {
+        extraConfig = ''
+                    import security_headers
+                    import csp
+                    ${antiScrape}
+                    root * /srv/jory
+                    file_server
+                    try_files {path} /index.html
+                    encode zstd gzip
+                    header Strict-Transport-Security "max-age=31536000;"
+                    @robots path /robots.txt
+                    handle @robots {
+                      header Content-Type text/plain
+                      respond `User-agent: *
+          Allow: /
+
+          User-agent: Googlebot
+          Allow: /
+
+          User-agent: Bingbot
+          Allow: /
+
+          User-agent: Twitterbot
+          Allow: /
+
+          User-agent: facebookexternalhit
+          Allow: /
+
+          User-agent: GPTBot
+          User-agent: ChatGPT-User
+          User-agent: OAI-SearchBot
+          User-agent: ClaudeBot
+          User-agent: Claude-Web
+          User-agent: anthropic-ai
+          User-agent: PerplexityBot
+          User-agent: Bytespider
+          User-agent: Amazonbot
+          User-agent: CCBot
+          User-agent: Google-Extended
+          User-agent: Applebot-Extended
+          Disallow: /
+          ` 200
+                    }
+        '';
+      };
+
+      "mta-sts.severijnse.eu" = {
+        extraConfig = ''
+          import security_headers
+          import csp
+          root * /srv
+          file_server
+          header Content-Type text/plain
+          header Cache-Control "public, max-age=300"
+          header X-Content-Type-Options nosniff
+        '';
+      };
+
+      "vault.severijnse.eu" = {
+        extraConfig = ''
+          import security_headers
+          import csp
+          ${antiScrape}
+          import admin_gate
+          header Strict-Transport-Security "max-age=31536000;"
+          reverse_proxy 127.0.0.1:1001
+          encode zstd gzip
+        '';
+      };
+
+      "git.severijnse.eu" = {
+        extraConfig = ''
+          import security_headers
+          import csp
+          ${antiScrape}
+          reverse_proxy 127.0.0.1:3000
+          encode zstd gzip
+        '';
+      };
+
+      "mail.severijnse.eu" = {
+        extraConfig = ''
+          import security_headers
+          ${antiScrape}
+          reverse_proxy 127.0.0.1:8888 {
+            # Strip copies set by the upstream SnappyMail container so we
+            # emit exactly one correct value of each security header.
+            header_down -X-Frame-Options
+            header_down -X-XSS-Protection
+            header_down -X-Content-Type-Options
+          }
+          encode zstd gzip
+        '';
+      };
+
+      "vpn.severijnse.eu" = {
+        extraConfig = ''
+          import security_headers
+          import csp
+          reverse_proxy 127.0.0.1:51821
+          encode zstd gzip
+        '';
+      };
+
+      "mine.severijnse.eu" = {
+        extraConfig = ''
+          import security_headers
+          import csp
+          ${antiScrape}
+          reverse_proxy 127.0.0.1:81
+        '';
+      };
+
+      "music.severijnse.eu" = {
+        extraConfig = ''
+          import security_headers
+          import csp
+          ${antiScrape}
+          reverse_proxy 127.0.0.1:4321
+        '';
+      };
+
+      "fail2ban.severijnse.eu" = {
+        extraConfig = ''
+          import security_headers
+          import csp
+          ${antiScrape}
+          import admin_gate
+          reverse_proxy 127.0.0.1:8080
+        '';
+      };
+
+      "automate.severijnse.eu" = {
+        extraConfig = ''
+          import security_headers
+          import csp
+          ${antiScrape}
+          import admin_gate
+          reverse_proxy 127.0.0.1:5678
+          encode zstd gzip
+        '';
+      };
+
+      "pay.severijnse.eu" = {
+        extraConfig = ''
+          import security_headers
+          import csp
+          ${antiScrape}
+          import admin_gate
+          reverse_proxy 127.0.0.1:5000
+          encode zstd gzip
+        '';
+      };
+
+      "http://ip.severijnse.eu" = {
+        extraConfig = ''
+          import security_headers
+          import csp
+          header Content-Type text/plain
+          respond {client_ip} 200
+        '';
+      };
+    };
+  };
+
+  systemd.tmpfiles.rules = [
+    "d /srv 0755 caddy caddy -"
+    "d /srv/jory 0755 caddy caddy -"
+  ];
+}