infra.ingress
25 options
infra.ingress.acmeCA
ACME CA directory URL (default: fleet.settings.internalCa.acmeDirectory). null ⇒ Let’s Encrypt production.
Type: null or string
Default:
config.fleet.settings.internalCa.acmeDirectory
Example:
"https://ca.example.internal:9000/acme/acme/directory"
Declared by: nix/modules/infra/ingress
infra.ingress.acmeCARootCert
Path to the ACME CA’s root certificate (default: fleet.settings.internalCa.certFile). Required with an internal CA.
Type: null or string
Default:
`config.fleet.settings.internalCa.certFile` (as a string) when set, else `null`
Declared by: nix/modules/infra/ingress
infra.ingress.acmeDnsApiBase
acme-dns update API base URL (the edge acme-dns host). Used by the acmedns DNS-01 provider to write _acme-challenge TXT records.
Type: string
Default:
"http://ingress.${config.fleet.settings.domain.internal}:8081"
Declared by: nix/modules/infra/ingress
infra.ingress.dataDir
Directory for Caddy data (certs, OCSP staples).
Type: string
Default:
"/var/lib/caddy"
Declared by: nix/modules/infra/ingress
infra.ingress.devCertIssuer
DNS-01 provider for public base-domain Let’s Encrypt certs:
- “cloudflare” (default, legacy): raw zone-wide Cloudflare token on this host. Being retired per ADR-026.
- “acmedns”: scoped per-host acme-dns credential (from
fleet pki acme-dns register <host>), no Cloudflare token on the host. Flip per-host during rollout, then make it the default.
Type: one of "cloudflare", "acmedns"
Default:
"cloudflare"
Declared by: nix/modules/infra/ingress
infra.ingress.devDomain
Auto-add public base-domain vhosts with Let’s Encrypt DNS-01 certs alongside the internal-domain ones.
Type: boolean
Default:
true
Declared by: nix/modules/infra/ingress
infra.ingress.email
Email for ACME account registration. Must be non-null when infra.ingress is enabled (asserted).
Type: null or string
Default:
config.fleet.settings.acmeEmail
Declared by: nix/modules/infra/ingress
infra.ingress.enable
Whether to enable Caddy reverse proxy with automatic HTTPS.
Type: boolean
Default:
false
Example:
true
Declared by: nix/modules/infra/ingress
infra.ingress.forwardAuth
When set, inject Authentik forward_auth into all auto-generated public base-domain vhosts. Defaults to enabled with the fleet’s configured outpost (fleet.settings.auth.outpostUrl). Set to null to disable.
Type: null or (submodule)
Default:
{ }
Declared by: nix/modules/infra/ingress
infra.ingress.forwardAuth.exclude
Service names (caddy.hostname values) to skip forward_auth. auth and headscale excluded by default to avoid redirect loops.
Type: list of string
Default:
[
"auth"
"headscale"
]
Declared by: nix/modules/infra/ingress
infra.ingress.forwardAuth.outpostUrl
Authentik embedded outpost base URL. null ⇒ no forward_auth injected.
Type: null or string
Default:
config.fleet.settings.auth.outpostUrl
Declared by: nix/modules/infra/ingress
infra.ingress.globalConfig
Extra global Caddyfile directives.
Type: strings concatenated with "\n"
Default:
""
Declared by: nix/modules/infra/ingress
infra.ingress.letsencryptDirectory
ACME directory for public Let’s Encrypt issuance (publicHttp01VirtualHosts). Point at the staging directory to test without burning prod rate limits.
Type: string
Default:
"https://acme-v02.api.letsencrypt.org/directory"
Example:
"https://acme-staging-v02.api.letsencrypt.org/directory"
Declared by: nix/modules/infra/ingress
infra.ingress.publicHttp01VirtualHosts
Public virtual hosts whose Let’s Encrypt cert is obtained over HTTP-01 / TLS-ALPN-01 — no DNS provider, no Cloudflare token, no acme-dns credential, no wildcard. Use for public names whose DNS is not in a zone we control. Each vhost overrides the global acme_ca (internal step-ca) with the public LE directory.
Type: attribute set of (submodule)
Default:
{ }
Example:
{ "www.example.org".extraConfig = "reverse_proxy http://127.0.0.1:8080"; }
Declared by: nix/modules/infra/ingress
infra.ingress.publicHttp01VirtualHosts.<name>.extraConfig
Caddyfile directives for this vhost (TLS handled by the injected Let’s Encrypt HTTP-01/TLS-ALPN-01 issuer).
Type: strings concatenated with "\n"
Default:
""
Declared by: nix/modules/infra/ingress
infra.ingress.publicVirtualHosts
Virtual hosts with Let’s Encrypt certs via Cloudflare DNS-01.
Type: attribute set of (submodule)
Default:
{ }
Example:
{ "app.example.dev".extraConfig = "reverse_proxy http://127.0.0.1:8080"; }
Declared by: nix/modules/infra/ingress
infra.ingress.publicVirtualHosts.<name>.extraConfig
Caddyfile directives for this public virtual host.
Type: strings concatenated with "\n"
Default:
""
Declared by: nix/modules/infra/ingress
infra.ingress.redirectPveToDev
Emit 301 redirects from internal-domain service vhosts to their public base-domain equivalents.
Type: boolean
Default:
false
Declared by: nix/modules/infra/ingress
infra.ingress.services
Services to reverse-proxy. Set automatically by infra modules.
Type: attribute set of (submodule)
Default:
{ }
Example:
{ grafana = { name = "grafana"; port = 3000; }; }
Declared by: nix/modules/infra/ingress
infra.ingress.services.<name>.host
Upstream host. Defaults to localhost.
Type: string
Default:
"127.0.0.1"
Declared by: nix/modules/infra/ingress
infra.ingress.services.<name>.name
Service name — becomes the FQDN prefix (
Type: string
Default: none (required when its feature is enabled)
Declared by: nix/modules/infra/ingress
infra.ingress.services.<name>.path
URL path. ‘/’ = own vhost. ‘/foo’ = path under hostname vhost.
Type: string
Default:
"/"
Declared by: nix/modules/infra/ingress
infra.ingress.services.<name>.port
Backend port on this host.
Type: 16 bit unsigned integer; between 0 and 65535 (both inclusive)
Default: none (required when its feature is enabled)
Declared by: nix/modules/infra/ingress
infra.ingress.virtualHosts
Additional manual virtual host definitions.
Type: attribute set of (submodule)
Default:
{ }
Example:
{ "wiki.example.pve".extraConfig = "reverse_proxy http://127.0.0.1:8000"; }
Declared by: nix/modules/infra/ingress
infra.ingress.virtualHosts.<name>.extraConfig
Caddyfile directives for this virtual host.
Type: strings concatenated with "\n"
Default:
""
Declared by: nix/modules/infra/ingress