NixOS AI Caddy proxy

nixos_ai_caddy_proxy.md

File	Description
.sops.yaml	Encryption rules and public keys. Personal key (to edit secrets manually): age-keygen -o ~/.config/sops/age/keys.txt The output shows the public key used to encrypt your personal files. Replace the username pierre with your own and substitute the associated value with the command output. Machine key: ssh-to-age < /etc/ssh/ssh_host_ed25519_key.pub The output shows the machine key (for automatic decryption at boot). Replace the host name pierre-nixos with yours and substitute the associated value with the command output. The corresponding private key (/etc/ssh/ssh_host_ed25519_key) is already present on the machine and will be used automatically by sops‑nix at boot, so you do not need to generate it. Update the user and host names at the end of the file.
ai-config.nix	Configuration file you edit: • secretsFile – path to the key file generated by sops. • port – shared local port used by all proxies. • providers – list of API services to proxy, each containing: - hostname – local virtual name (e.g., groq.proxy → 127.0.0.1). - target – real service URL. - keyEnvVar – name of the variable in api-proxy.env. - sessionVars – environment variables (mapping) exposed to CLI tools (Aider, etc.) pointing to the local proxy with a dummy key value.
modules/api-proxy.nix	Defines the NixOS services.api-proxy module. It dynamically generates a Caddyfile from the list of upstreams, configures Caddy with authentication headers ({env.VAR}), creates local DNS entries in /etc/hosts (groq.proxy → 127.0.0.1, etc.), and passes the secrets file to Caddy via a systemd EnvironmentFile.
modules/ai.nix	Bridge between ai-config.nix and the api‑proxy module. It reads the provider configuration (Groq, OpenAI, …), extracts sessionVars (dummy keys pointing to the local proxy) to inject into the session environment, and enables the api‑proxy service with the correct port and secrets file.
modules/ai-tools.nix	Installs AI tooling for your user: Open WebUI (web interface), Aider, Claude Code and OpenCode. This file is optional.
modules/sops/*.nix	Configuration for sops, handling decryption of encrypted secrets at build/boot time. Copy and adjust to match your setup. sops-proxy.nix is probably the only file you need. What to adapt: • defaultSopsFile — path to your encrypted sops file for API proxy keys. • secrets — one entry per key in your sops files; add sopsFile to override defaultSopsFile for a given secret; set owner if a user-space script needs to read the secret directly. • templates — composed files built from secrets at boot; adjust api-proxy.env to list only the keys used by your proxy, and remove or replace geoclue.conf if you don't use it.
sops/api-proxy.yaml	Encrypted secrets used by Caddy. You need to create this file with sops (sops api-proxy.yaml).
sops/secrets.yaml	Encrypted secrets (e.g., Geoclue, iCloud). You need to create this file with sops (sops secrets.yaml).
userdata.nix	Config user data. You'll probably just need to set your own user name.