add acme for caddy

nixos/common/caddy/custom-caddy.nix

···
-{ pkgs, config, plugins, stdenv, lib, ... }:
-
-stdenv.mkDerivation rec {
-  pname = "caddy";
-  # https://github.com/NixOS/nixpkgs/issues/113520
-  version = "2.7.6";
-  dontUnpack = true;
-
-  nativeBuildInputs = [ pkgs.git pkgs.go pkgs.xcaddy ];
-
-  configurePhase = ''
-    export GOCACHE=$TMPDIR/go-cache
-    export GOPATH="$TMPDIR/go"
-  '';
-
-  buildPhase =
-    let
-      pluginArgs =
-        lib.concatMapStringsSep " " (plugin: "--with ${plugin}") plugins;
-    in
-    ''
-      runHook preBuild
-      ${pkgs.xcaddy}/bin/xcaddy build "v${version}" ${pluginArgs}
-      runHook postBuild
-    '';
-
-  installPhase = ''
-    runHook preInstall
-    mkdir -p $out/bin
-    mv caddy $out/bin
-    runHook postInstall
-  '';
-}

nixos/common/caddy/default.nix

···
-{ config, pkgs, lib, ... }:
-
-with lib;
-
-{
-    nix.settings.sandbox = false;
-    
-  services.caddy = {
-    enable = true;
-    package = (pkgs.callPackage ./custom-caddy.nix {
-      plugins = [ "github.com/caddy-dns/cloudflare" ];
-    });
-
-    virtualHosts."localhost".extraConfig = ''
-      respond "OK"
-    '';
-  };
-  networking.firewall.allowedTCPPorts = [
-    80
-    443
-  ];
-}

nixos/ferret/caddy.nix

···
     443
   ];
 
+  security.acme = {
+    acceptTerms = true;
+    defaults.email = "[e-mail]";
+
+    certs."ferret.otter.place" = {
+      extraDomainNames = [ "*.ferret.otter.place" ];
+      dnsProvider = "cloudflare";
+      dnsPropagationCheck = true;
+      # Supplying password files like this will make your credentials world-readable
+      # in the Nix store. This is for demonstration purpose only, do not use this in production.
+      environmentFile = "${pkgs.writeText "cloudflare-creds" ''
+        CLOUDFLARE_EMAIL=xxxxxxxxxx
+        CLOUDFLARE_API_KEY=yyyyyyyyyy
+      ''}";
+    };
+  };
+
   services.caddy = {
     enable = true;
     virtualHosts."localhost".extraConfig = ''

nixos/ferret/default.nix

···
         ./configuration.nix
         ./hardware-configuration.nix
         ./media.nix
-        ../common/caddy
+        ./caddy.nix
     ];
 
     security.polkit.enable = true;