wafrn-nix

Example:

{
  inputs.wafrn-nix.url = "git+https://git.ocbwoy3.dev/kris/wafrn-nix";

  outputs = { self, nixpkgs, wafrn-nix, ... }: {
    nixosConfigurations.myhost = nixpkgs.lib.nixosSystem {
      system = "x86_64-linux";
      modules = [
        wafrn-nix.nixosModules.default
        ({ ... }: {
          virtualisation.docker.enable = true;

          services.wafrn = {
            enable = true;
            # package = my-wafrn-src-package;

            # optional: override source checkout path
            # source = "/srv/wafrn";
            stateDir = "/var/lib/wafrn";
            secretsFile = "/run/secrets/wafrn.env";

            # cloudflared doesnt need https:
            # httpPort = 8080;
            # httpsPort = null;

            environment = {
              DOMAIN_NAME = "wafrn.example.com";
              CACHE_DOMAIN = "cache.wafrn.example.com";
              MEDIA_DOMAIN = "media.wafrn.example.com";
              FRONTEND_MEDIA_URL = "https://media.wafrn.example.com";
              FRONTEND_CACHE_URL = "https://cache.wafrn.example.com/api/cache?media=";
              FRONTEND_FQDN_URL = "https://wafrn.example.com";
              ACME_EMAIL = "admin@example.com";
            };
          };
        })
      ];
    };
  };
}