I guess i forgot to add networking

networking/caddy.nix

@@ -0,0 +1,135 @@
+{pkgs, ... } : {
+  imports = [
+    ./networkSetup.nix
+  ];
+
+  services.caddy.virtualHosts."immich.deprived.dev" = {
+    extraConfig = ''
+        reverse_proxy * 127.0.0.1:2283
+    '';
+  };
+
+
+  services.caddy.virtualHosts."ha.deprived.dev" = {
+    extraConfig = ''
+        reverse_proxy * 127.0.0.1:8123
+    '';
+  };
+
+  services.caddy.virtualHosts."jelly.deprived.dev" = {
+    extraConfig = ''
+        reverse_proxy * 127.0.0.1:8096
+    '';
+  };
+
+
+  services.caddy.virtualHosts."pocket.deprived.dev" = {
+    extraConfig = ''
+        reverse_proxy * 127.0.0.1:5500
+    '';
+  };
+
+  services.caddy.virtualHosts."seer.deprived.dev" = {
+    extraConfig = ''
+        reverse_proxy * 127.0.0.1:5055
+    '';
+  };
+
+  services.caddy.virtualHosts."development.deprived.dev" = {
+    extraConfig = ''
+        reverse_proxy * 127.0.0.1:5550
+    '';
+  };
+
+services.caddy.virtualHosts."spotify.api.deprived.dev" = {
+  extraConfig = ''
+    encode zstd gzip
+
+    # --- CORS: preflight (OPTIONS) ---
+    @preflight {
+      method OPTIONS
+      header Origin *
+      header Access-Control-Request-Method *
+    }
+    handle @preflight {
+      header {
+        Access-Control-Allow-Origin "{http.request.header.Origin}"
+        Access-Control-Allow-Methods "GET, POST, PUT, PATCH, DELETE, OPTIONS"
+        Access-Control-Allow-Headers "{http.request.header.Access-Control-Request-Headers}"
+        Access-Control-Allow-Credentials "true"
+        Access-Control-Max-Age "600"
+        Vary "Origin"
+      }
+      respond 204
+    }
+
+    # --- Auth: protect everything except OPTIONS ---
+    @protected {
+      not method OPTIONS
+    }
+    basicauth @protected {
+      alice $2a$14$GbqQnETcOz5fNEbS06Y0E.HxRIIgPKAK7OMijT1Bv63h3V6S/gwRG
+    }
+
+    # --- Reverse proxy: strip upstream CORS so we don't end up with duplicates ---
+    reverse_proxy 127.0.0.1:6666 {
+      header_down -Access-Control-Allow-Origin
+      header_down -Access-Control-Allow-Methods
+      header_down -Access-Control-Allow-Headers
+      header_down -Access-Control-Allow-Credentials
+      header_down -Vary
+    }
+
+    # --- CORS: set headers on actual responses (only when Origin is present) ---
+    @cors header Origin *
+    header @cors {
+      Access-Control-Allow-Origin "{http.request.header.Origin}"
+      Access-Control-Allow-Credentials "true"
+      # Optionally expose any headers your frontend needs to read:
+      # Access-Control-Expose-Headers "Content-Type, Content-Length, Date"
+      Vary "Origin"
+    }
+  '';
+};
+
+
+services.caddy.virtualHosts."spotify.playing.deprived.dev" = {
+  extraConfig = ''
+    encode zstd gzip
+
+    @preflight method OPTIONS
+    handle @preflight {
+      header {
+        Access-Control-Allow-Origin "{http.request.header.Origin}"
+        Access-Control-Allow-Methods "GET, POST, PUT, PATCH, DELETE, OPTIONS"
+        Access-Control-Allow-Headers "{http.request.header.Access-Control-Request-Headers}"
+        Access-Control-Allow-Credentials "true"
+        Access-Control-Max-Age "600"
+        Vary "Origin"
+      }
+      respond 204
+    }
+
+    @protected not method OPTIONS
+    basicauth @protected {
+      alice $2a$14$GbqQnETcOz5fNEbS06Y0E.HxRIIgPKAK7OMijT1Bv63h3V6S/gwRG
+    }
+
+    reverse_proxy 127.0.0.1:8800
+
+    header {
+      Access-Control-Allow-Origin "{http.request.header.Origin}"
+      Access-Control-Allow-Methods "GET, POST, PUT, PATCH, DELETE, OPTIONS"
+      Access-Control-Allow-Headers "{http.request.header.Access-Control-Request-Headers}"
+      Access-Control-Allow-Credentials "true"
+      Vary "Origin"
+    }
+  '';
+};
+
+  services.caddy.virtualHosts."lyrics.deprived.dev" = {
+    extraConfig = ''
+        reverse_proxy * 127.0.0.1:7444
+    ''; 
+  };
+}

networking/networkSetup.nix

@@ -0,0 +1,8 @@
+{pkgs, ... } : { 
+  services.caddy.enable = true;
+
+  security.acme.acceptTerms = true;
+  security.acme.defaults.email = "zhen@deprived.dev";
+  networking.firewall.enable = false;
+
+}