Skip to content

moving off cloudflare #294

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
RichieCahill merged 4 commits into from
Apr 13, 2026
Merged

moving off cloudflare #294

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
385587a
moving off cloudflare tunnel
RichieCahill Apr 13, 2026
400b8e5
updated gitea ssh settings
RichieCahill Apr 13, 2026
4e0932c
ran tree fmt
RichieCahill Apr 13, 2026
8d4ba8e
made web_services dir
RichieCahill Apr 13, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 0 additions & 1 deletion .vscode/settings.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -40,7 +40,6 @@
"cgroupdriver",
"charliermarsh",
"Checkpointing",
"cloudflared",
"codellama",
"codezombiech",
"compactmode",
Expand Down
1 change: 1 addition & 0 deletions systems/jeeves/default.nix
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,6 +15,7 @@ in
"${inputs.self}/common/optional/zerotier.nix"
./docker
./services
./web_services
./hardware.nix
./networking.nix
./programs.nix
Expand Down
17 changes: 0 additions & 17 deletions systems/jeeves/services/cloud_flare_tunnel.nix
View file
Open in desktop

This file was deleted.

7 changes: 5 additions & 2 deletions systems/jeeves/services/gitea.nix
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,10 @@ let
vars = import ../vars.nix;
in
{
networking.firewall.allowedTCPPorts = [ 6443 ];
networking.firewall.allowedTCPPorts = [
6443
2223
];

services.gitea = {
enable = true;
Expand All @@ -24,7 +27,7 @@ in
ROOT_URL = "https://gitea.tmmworkshop.com/";
HTTP_PORT = 6443;
SSH_PORT = 2223;
SSH_LISTEN_PORT = 2224;
SSH_LISTEN_PORT = 2223;
START_SSH_SERVER = true;
PUBLIC_URL_DETECTION = "auto";
};
Expand Down
1 change: 0 additions & 1 deletion systems/jeeves/services/validate_system.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,6 @@
zpool = ["root_pool", "storage", "media"]
services = [
"audiobookshelf",
"cloud_flare_tunnel",
"haproxy",
"docker",
"home-assistant",
Expand Down
62 changes: 62 additions & 0 deletions systems/jeeves/web_services/acme.nix
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,62 @@
let
domains = [
"audiobookshelf"
"cache"
"gitea"
"jellyfin"
"share"
];

makeCert = name: {
name = "${name}.tmmworkshop.com";
value = {
webroot = "/var/lib/acme/.challenges";
group = "acme";
reloadServices = [ "haproxy.service" ];
};
};

acmeServices = map (domain: "acme-${domain}.tmmworkshop.com.service") domains;
in
{
users.users.haproxy.extraGroups = [ "acme" ];

security.acme = {
acceptTerms = true;
defaults.email = "Richie@tmmworkshop.com";
certs = builtins.listToAttrs (map makeCert domains);
};

# Minimal nginx to serve ACME HTTP-01 challenge files for HAProxy
services.nginx = {
enable = true;
virtualHosts."acme-challenge" = {
listen = [
{
addr = "127.0.0.1";
port = 8402;
}
];
locations."/.well-known/acme-challenge/" = {
root = "/var/lib/acme/.challenges";
};
};
};

# Ensure the challenge directory exists with correct permissions
systemd.tmpfiles.rules = [
"d /var/lib/acme/.challenges 0750 acme acme - -"
"d /var/lib/acme/.challenges/.well-known 0750 acme acme - -"
"d /var/lib/acme/.challenges/.well-known/acme-challenge 0750 acme acme - -"
];

users.users.nginx.extraGroups = [ "acme" ];

# HAProxy needs certs to exist before it can bind :443.
# NixOS's acme module generates self-signed placeholders on first boot
# via acme-<domain>.service — just make HAProxy wait for them.
systemd.services.haproxy = {
after = acmeServices;
wants = acmeServices;
};
}
9 changes: 9 additions & 0 deletions systems/jeeves/web_services/default.nix
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,9 @@
{ lib, ... }:
{
imports =
let
files = builtins.attrNames (builtins.readDir ./.);
nixFiles = builtins.filter (name: lib.hasSuffix ".nix" name && name != "default.nix") files;
in
map (file: ./. + "/${file}") nixFiles;
}
33 changes: 19 additions & 14 deletions systems/jeeves/services/haproxy.cfg → systems/jeeves/web_services/haproxy.cfg
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,6 +6,7 @@ global
defaults
log global
mode http
option httplog
retries 3
maxconn 2000
timeout connect 5s
Expand All @@ -22,25 +23,37 @@ defaults
#Application Setup
frontend ContentSwitching
bind *:80 v4v6
bind *:443 v4v6 ssl crt /zfs/storage/secrets/docker/cloudflare.pem
bind *:443 v4v6 ssl crt /var/lib/acme/audiobookshelf.tmmworkshop.com/full.pem crt /var/lib/acme/cache.tmmworkshop.com/full.pem crt /var/lib/acme/jellyfin.tmmworkshop.com/full.pem crt /var/lib/acme/share.tmmworkshop.com/full.pem crt /var/lib/acme/gitea.tmmworkshop.com/full.pem
mode http

# ACME challenge routing (must be first)
acl is_acme path_beg /.well-known/acme-challenge/
use_backend acme_challenge if is_acme
Comment on lines +26 to +31
Copy link
Copy Markdown

@coderabbitai coderabbitai bot Apr 13, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🔴 Critical

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "Searching for any bootstrap certificate or fallback TLS path..."
rg -n -C2 '/var/lib/acme/.*/full\.pem|full\.pem|cloudflare\.pem|self-?signed|mkcert|openssl|bind \*:443|security\.acme' systems

Repository: RichieCahill/dotfiles

Length of output: 977

🏁 Script executed:

cat -n systems/jeeves/services/acme.nix | head -60

Repository: RichieCahill/dotfiles

Length of output: 2100

🏁 Script executed:

# Check for any bootstrap scripts, initialization, or pre-seeded certificates
find systems -type f \( -name "*.sh" -o -name "*.nix" \) | xargs rg -l "bootstrap|init|pre.*cert|seeded|temporary.*pem" | head -20

Repository: RichieCahill/dotfiles

Length of output: 214

🏁 Script executed:

# Check if there are any HAProxy-specific bootstrap mechanisms or optional cert handling
rg -n -A5 -B5 "bind.*ssl|crt|certFile|sslCertificates" systems/jeeves/services/haproxy.cfg

Repository: RichieCahill/dotfiles

Length of output: 589

This breaks first-time ACME bootstrap.

Line 26 makes HAProxy require /var/lib/acme/*/full.pem to start on :443, but those files do not exist on a fresh host until ACME succeeds. In this setup, ACME's HTTP-01 validation depends on HAProxy already serving :80 and forwarding /.well-known/acme-challenge/ to nginx at 127.0.0.1:8402 (lines 29-31, configured in systems/jeeves/services/acme.nix). This creates a circular dependency: HAProxy cannot start without the certs, and ACME cannot provision the certs without HAProxy running.

A bootstrap path is needed: e.g. seed a temporary self-signed PEM, use an optional certificate binding, or provision the HTTP-01 responder on a separate listener that starts before TLS binding.

🤖 Prompt for AI Agents 
Verify each finding against the current code and only fix it if needed.

In `@systems/jeeves/services/haproxy.cfg` around lines 26 - 31, The TLS bind on
bind *:443 currently requires /var/lib/acme/*/full.pem to exist which prevents
HAProxy from starting before ACME completes; change the bootstrap so HAProxy can
start without real certs by adding a fallback self-signed PEM (e.g.
/var/lib/acme/seed.pem) or use a crt-list fallback and reference it in the same
bind line (bind *:443 ssl crt /var/lib/acme/seed.pem crt
/var/lib/acme/cache.tmmworkshop.com/full.pem ...), and ensure your
init/bootstrap creates the seed PEM if missing; keep the ACME routing ACLs (acl
is_acme, use_backend acme_challenge) as-is so HTTP-01 requests forwarded to
nginx can provision real certs which will replace the seed.


# tmmworkshop.com
acl host_audiobookshelf hdr(host) -i audiobookshelf.tmmworkshop.com
acl host_cache hdr(host) -i cache.tmmworkshop.com
acl host_jellyfin hdr(host) -i jellyfin.tmmworkshop.com
acl host_share hdr(host) -i share.tmmworkshop.com
acl host_gcw hdr(host) -i gcw.tmmworkshop.com
acl host_n8n hdr(host) -i n8n.tmmworkshop.com
acl host_gitea hdr(host) -i gitea.tmmworkshop.com

# Hosts allowed to serve plain HTTP (add entries to skip the HTTPS redirect)
acl allow_http hdr(host) -i __none__
# acl allow_http hdr(host) -i example.tmmworkshop.com

# Redirect all HTTP to HTTPS unless on the allow list or ACME challenge
http-request redirect scheme https code 301 if !{ ssl_fc } !allow_http !is_acme

use_backend audiobookshelf_nodes if host_audiobookshelf
use_backend cache_nodes if host_cache
use_backend jellyfin if host_jellyfin
use_backend share_nodes if host_share
use_backend gcw_nodes if host_gcw
use_backend n8n if host_n8n
use_backend gitea if host_gitea

backend acme_challenge
mode http
server acme 127.0.0.1:8402

backend audiobookshelf_nodes
mode http
server server 127.0.0.1:8000
Expand All @@ -60,14 +73,6 @@ backend share_nodes
mode http
server server 127.0.0.1:8091

backend gcw_nodes
mode http
server server 127.0.0.1:8092

backend n8n
mode http
server server 127.0.0.1:5678

backend gitea
mode http
server server 127.0.0.1:6443
server server 127.0.0.1:6443
0 systems/jeeves/services/haproxy.nix → systems/jeeves/web_services/haproxy.nix
View file
Open in desktop
File renamed without changes.
Loading