Skip to content

Commit

Permalink
nixos/wordpress: Use https by default for caddy
Browse files Browse the repository at this point in the history
Previously, `http://` scheme was hard coded into the caddy config if
`webserver = "caddy"` was chosen. This is fine for local testing, but is
problematic if you want your nixos host to be public facing.

In the public facing case, you generally want to be using TLS. But since
the wordpress module generates the caddyfile rule, the user's nixos
config cannot easily change it to also allow https.

An alternative would be to reverse proxy an https rule to the generated
http rule, but that's somewhat questionable as there's not an internal
http endpoint to proxy to. It might be possible but I couldn't figure
it out.

So simplify by omitting the scheme. This causes caddy to use https by
default and 301 redirect any http requests to the https endpoint. Caddy
will just do the right thing if it's being hosted on a local/internal
hostname (self sign certificates).

This should be backwards compatible with previous default if users are
using reasonable browsers/tools.
  • Loading branch information
danobi committed Jan 20, 2025
1 parent 041c867 commit f7cf5c8
Show file tree
Hide file tree
Showing 2 changed files with 2 additions and 2 deletions.
2 changes: 1 addition & 1 deletion nixos/modules/services/web-apps/wordpress.nix
Original file line number Diff line number Diff line change
Expand Up @@ -545,7 +545,7 @@ in
services.caddy = {
enable = true;
virtualHosts = mapAttrs' (hostName: cfg: (
nameValuePair "http://${hostName}" {
nameValuePair hostName {
extraConfig = ''
root * /${pkg hostName cfg}/share/wordpress
file_server
Expand Down
2 changes: 1 addition & 1 deletion nixos/tests/wordpress.nix
Original file line number Diff line number Diff line change
Expand Up @@ -76,7 +76,7 @@ import ./make-test-python.nix (
};
};

networking.firewall.allowedTCPPorts = [ 80 ];
networking.firewall.allowedTCPPorts = [ 80 443 ];
networking.hosts."127.0.0.1" = [
"site1.local"
"site2.local"
Expand Down

0 comments on commit f7cf5c8

Please sign in to comment.