vicarian-dns01.corn

let {
    $env_PORKBUN_KEY = "fallback value"
    $env_PORKBUN_SECRET = "fallback value"

} in {
    listen = {
        addrs = [
            "[::]"   // Default; this covers IPv4 & IPv6
        ]
        insecure_port = 80 // Default; will redirect to TLS
        tls_port = 443 // Default
    }

    vhosts = [
        {
            hostname = "files.example.com"
            // Optional aliases for this host. These will be added to
            // the generated TLS certificate.
            aliases = [
                "docs.example.com"
                "pics.example.com"
            ]

            tls = {
                acme = {
                    acme_provider = "letsencrypt"  // Default & only supported provider ATM
                    contact = "admin@example.com"
                    challenge = {
                        type = "dns-01"
                        dns_provider = {
                            name = "porkbun"
                            key = $env_PORKBUN_KEY
                            secret = $env_PORKBUN_SECRET
                        }
                    }

                }
            }

            backends = [
                {
                    // A service that does not allow a custom root/context,
                    // so we must place at root.
                    context = "/"
                    url = "http://localhost:8443"
                    // This service enforces TLS with a self-signed cert, so
                    // we need to disable certificate verification.
                    //
                    // Looking at you Unifi Controller.
                    trust = true
                }
                {
                    // A better behaved service that allows a custom root.
                    context = "/copyparty"
                    url = "http://localhost:9090"
                }
            ]
        }
    ]
}