configure cloudflare dns and wildcard nginx

nixos/.sops.yaml

@@ -2,7 +2,7 @@
 keys:
   - &homelab age1ldgnl53dmvl4fjz6hgdj0cvensagddn3ltpmxfm72m8q273w75fsk42p8v
 creation_rules:
-  - path_regex: secrets/build.json$
+  - path_regex: secrets/[^/]+\.(yaml|json|env|ini)$
     key_groups:
     - age:
       - *homelab

nixos/configuration.nix

@@ -9,11 +9,16 @@
   # Secret Management
   sops = {
     age.keyFile = "./age/keys.txt"; # Make sure to gitignore, contains private key.
-
-    defaultSopsFile = ./secrets/build.json;
     defaultSopsFormat = "json";
 
-    secrets."clusterPassword" = { };
+    secrets = {
+      "clusterPassword" = {
+        sopsFile = ./secrets/build.json;
+      };
+      "cloudflare-credentials" = {
+        sopsFile = ./secrets/cloudflare.json;
+      };
+    };
   };
 
   systemd.user.services.mbsync.unitConfig.After = [ "sops-nix.service" ];
@@ -22,6 +27,32 @@
     SECRETKEY = "${config.sops.secrets."clusterPassword".path}";
   };
 
+  # set up DNS with nginx
+  security.acme = {
+    acceptTerms = true;
+    defaults = {
+      email = "roydumblauskas@gmail.com";
+      dnsProvider = "cloudflare";
+      credentialsFile = config.sops.secrets."cloudflare-credentials".path;
+    };
+  };
+
+  services.nginx = {
+    enable = true;
+    virtualHosts = {
+      "roypository.com" = {
+        forceSSL = true;
+        enableACME = true;
+        addSSL = true;
+      };
+      "*.roypository.com" = {
+        forceSSL = true;
+        enableACME = true;
+        addSSL = true;
+      };
+    };
+  };
+  
   # Grub Boot Loader Setup
   boot.loader.grub = {
     enable = true;

nixos/secrets/cloudflare.json

@@ -0,0 +1,20 @@
+{
+	"cloudflare-credentials": "ENC[AES256_GCM,data:GYmJx8Xzb5uMZ8UBpO8bsxH6N9FZQ0GpUM8gsJXp7Mtwioa/taWspwfxUxVqCVB1OuwQpMzMVuTPyAs4bS48nDEZ9YSwuyNU3UJ8zAUG1LzlXC6nSTA=,iv:ob7tqttc7ZcwXApBbuh5ahoDD9AUyEJK4+Bp6SR6Lvo=,tag:ZpFBcuR7MqW9fyFn7tBWNA==,type:str]",
+	"sops": {
+		"kms": null,
+		"gcp_kms": null,
+		"azure_kv": null,
+		"hc_vault": null,
+		"age": [
+			{
+				"recipient": "age1ldgnl53dmvl4fjz6hgdj0cvensagddn3ltpmxfm72m8q273w75fsk42p8v",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBiSVlXekdnZW02SlpUN0Zq\nS3hzVGtGdkRQRUMrNExqVEFaQnJrVVRNOXhVClJYT2dNVTFuSE9SYnlnSEJmdkUw\nS21pYmRSaFRIVlp5clVST3VTY0YyS1kKLS0tIE9Hd09QWk0xYzBuSzBnU3gzSmFZ\nWUo3T0EyeXUzVjA2SFNFR1QzeW84OUEKObVZ9D7NZPwRXj7OA7EAJtmarT76TnSb\n/SsZ6vU3hQ9Vcn5EIZ39+MpdFluyxZkoq+0di52BHkgExrUD8VD0Lg==\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2025-04-23T20:03:05Z",
+		"mac": "ENC[AES256_GCM,data:sPoetiHt7L/7GM8DezYal7Vfgz0/pN5Q2zBOABZwFyI7eRPwP9tSdklr4Bflofc7VEabZlH2sF81z3C8TdBZ5VJ2IpjZrTXd4B/U7CmbL+9FPiCoUqSB9xq0OtchsnrVLQCry16+3x8O4CXap2fH8AFgmUiGkTtgRVqkc7UsoeE=,iv:zz/7UGQYhVfHfR/tu6Uu6nUWojc8pCdBC8qHd4N/tTk=,tag:37whEAueDHeiYcvncEZTBw==,type:str]",
+		"pgp": null,
+		"unencrypted_suffix": "_unencrypted",
+		"version": "3.9.4"
+	}
+}