feat(hetzner): add Stalwart, restic backups, and virtualcam

servers/hetzner/modules/services/caddy.nix

@@ -1,4 +1,7 @@
-{...}: let
+{
+  unstablePkgs,
+  ...
+}: let
   antiScrape = ''
     @bad_bot {
       header_regexp User-Agent "(?i)(scrapy|cpython-requests|python-requests|curl|wget|go-http-client|ltx71|petalbot|bytespider|dotbot|ahrefsbot|semrushbot|mj12bot|dataforseo|facebookexternalhit|claudebot|anthropic-ai|perplexity|gptbot|chatgpt-user|omnisci|imgproxy|ccbot|exabot|360spider|baiduspider|sogou|duckduckgo|amazonbot|cohere-ai|diffbot|imagesiftbot).*"
@@ -12,6 +15,7 @@ in {
   services.caddy = {
     enable = true;
     group = "caddy";
+    package = unstablePkgs.caddy;
     dataDir = "/var/lib/caddy";
     logDir = "/var/log/caddy";
     globalConfig = ''
@@ -133,7 +137,6 @@ in {
           import security_headers
           import csp
           ${antiScrape}
-          import admin_gate
           header Strict-Transport-Security "max-age=31536000;"
           reverse_proxy 127.0.0.1:1001
           encode zstd gzip
@@ -154,13 +157,18 @@ in {
         extraConfig = ''
           import security_headers
           ${antiScrape}
-          reverse_proxy 127.0.0.1:8888 {
-            # Strip copies set by the upstream SnappyMail container so we
-            # emit exactly one correct value of each security header.
-            header_down -X-Frame-Options
-            header_down -X-XSS-Protection
-            header_down -X-Content-Type-Options
-          }
+          # Bulwark webmail (JMAP client for Stalwart), running on host port 3002.
+          reverse_proxy 127.0.0.1:3002
+          encode zstd gzip
+        '';
+      };
+
+      "admin.mail.severijnse.eu" = {
+        extraConfig = ''
+          import security_headers
+          ${antiScrape}
+          # Stalwart webadmin UI (served by the http-management listener on 8080).
+          reverse_proxy 127.0.0.1:8080
           encode zstd gzip
         '';
       };
@@ -224,6 +232,19 @@ in {
         '';
       };
 
+      "virtualcam.severijnse.eu" = {
+        extraConfig = ''
+          import security_headers
+          import csp
+          ${antiScrape}
+          basic_auth {
+            chan $2a$14$7ZeNpGT0L68uZwzdWBcF0OulzhrYbfAs232Ojt//LHQ1qvXU4x32O
+          }
+          reverse_proxy 127.0.0.1:3001
+          encode zstd gzip
+        '';
+      };
+
       "http://ip.severijnse.eu" = {
         extraConfig = ''
           import security_headers