snowflake/hosts/sakura/services/traefik.nix

159 lines
5.3 KiB
Nix
Raw Normal View History

2023-06-11 18:19:51 -04:00
{config, ...}: {
2023-05-28 22:00:50 -04:00
sops.secrets.cloudflare-api-key = {};
2023-06-19 18:45:47 -04:00
networking.firewall.allowedTCPPorts = [80 443];
2023-05-28 22:00:50 -04:00
systemd.services.traefik = {
environment = {
CLOUDFLARE_EMAIL = "jch0tm2e@notohh.dev";
};
2023-06-11 18:19:51 -04:00
serviceConfig = {
EnvironmentFile = [config.sops.secrets.cloudflare-api-key.path];
};
2023-05-28 22:00:50 -04:00
};
services.traefik = {
enable = true;
dynamicConfigOptions = {
http = {
2023-06-23 22:34:32 -04:00
middlewares.authelia = {
forwardauth = {
address = "http://localhost:9091/api/verify?rd=https://passport.notohh.dev/";
trustForwardHeader = true;
};
};
2023-05-28 22:00:50 -04:00
routers = {
api = {
rule = "PathPrefix(`/api/`)";
2023-06-23 22:34:32 -04:00
entrypoints = ["websecure"];
2023-05-28 22:00:50 -04:00
service = "api@internal";
};
dashdot = {
rule = "Host(`dashdot.sakura.internal.flake.sh`)";
entrypoints = ["web"];
service = "dashdot";
};
2023-06-19 18:43:32 -04:00
authelia = {
rule = "Host(`passport.notohh.dev`)";
entrypoints = ["websecure"];
service = "authelia";
tls.domains = [{main = "*.notohh.dev";}];
tls.certresolver = "production";
};
2023-05-28 22:00:50 -04:00
hugo = {
rule = "Host(`notohh.dev`)";
2023-06-19 18:43:32 -04:00
entrypoints = ["websecure"];
2023-05-28 22:00:50 -04:00
service = "hugo";
tls.domains = [{main = "*.notohh.dev";}];
tls.certresolver = "production";
2023-06-19 18:43:32 -04:00
middlewares = "authelia";
2023-05-28 22:00:50 -04:00
};
foundryvtt = {
2023-10-03 14:24:26 -04:00
rule = "Host(`foundry.flake.sh`)";
2023-05-28 22:00:50 -04:00
entrypoints = ["websecure"];
service = "foundryvtt";
2023-10-03 14:24:26 -04:00
tls.domains = [{main = "*.flake.sh";}];
2023-05-28 22:00:50 -04:00
tls.certresolver = "production";
};
2023-10-03 14:24:26 -04:00
forgejo = {
rule = "Host(`git.flake.sh`)";
2023-05-28 22:00:50 -04:00
entrypoints = ["websecure"];
2023-10-03 14:24:26 -04:00
service = "forgejo";
tls.domains = [{main = "*.flake.sh";}];
2023-05-28 22:00:50 -04:00
tls.certresolver = "production";
};
rustypaste = {
2023-10-03 14:24:26 -04:00
rule = "Host(`i.flake.sh`)";
2023-05-28 22:00:50 -04:00
entrypoints = ["websecure"];
service = "rustypaste";
2023-10-03 14:24:26 -04:00
tls.domains = [{main = "*.flake.sh";}];
2023-05-28 22:00:50 -04:00
tls.certresolver = "production";
};
grafana = {
2023-10-03 14:24:26 -04:00
rule = "Host(`metrics.flake.sh`)";
entrypoints = ["websecure"];
service = "grafana";
2023-10-03 14:24:26 -04:00
tls.domains = [{main = "*.flake.sh";}];
tls.certresolver = "production";
};
2023-06-11 05:10:20 -04:00
woodpecker-server = {
2023-10-03 14:24:26 -04:00
rule = "Host(`ci.flake.sh`)";
2023-06-11 05:10:20 -04:00
entrypoints = ["websecure"];
service = "woodpecker-server";
2023-10-03 14:24:26 -04:00
tls.domains = [{main = "*.flake.sh";}];
2023-06-12 00:04:26 -04:00
tls.certresolver = "production";
};
2023-06-13 15:17:23 -04:00
hedgedoc = {
2023-10-03 14:24:26 -04:00
rule = "Host(`scratch.flake.sh`)";
2023-06-13 15:17:23 -04:00
entrypoints = ["websecure"];
service = "hedgedoc";
2023-10-03 14:24:26 -04:00
tls.domains = [{main = "*.flake.sh";}];
2023-06-13 15:17:23 -04:00
tls.certresolver = "production";
};
2023-09-09 13:13:00 -04:00
vaultwarden = {
2023-10-03 14:24:26 -04:00
rule = "Host(`vault.flake.sh`)";
2023-09-09 13:13:00 -04:00
entrypoints = ["websecure"];
service = "vaultwarden";
2023-10-03 14:24:26 -04:00
tls.domains = [{main = "*.flake.sh";}];
2023-09-09 13:13:00 -04:00
tls.certresolver = "production";
};
2023-05-28 22:00:50 -04:00
};
services = {
2023-06-19 18:43:32 -04:00
authelia.loadBalancer.servers = [{url = "http://localhost:9091";}];
dashdot.loadBalancer.servers = [{url = "http://localhost:4000";}];
2023-05-28 22:00:50 -04:00
hugo.loadBalancer.servers = [{url = "http://localhost:1313";}];
foundryvtt.loadBalancer.servers = [{url = "http://localhost:30000";}];
2023-10-03 14:24:26 -04:00
forgejo.loadBalancer.servers = [{url = "http://localhost:3200";}];
2023-05-28 22:00:50 -04:00
rustypaste.loadBalancer.servers = [{url = "http://localhost:8000";}];
grafana.loadBalancer.servers = [{url = "http://localhost:3100";}];
2023-06-12 00:04:26 -04:00
woodpecker-server.loadBalancer.servers = [{url = "http://localhost:8200";}];
2023-06-13 15:17:23 -04:00
hedgedoc.loadBalancer.servers = [{url = "http://localhost:3300";}];
2023-09-09 13:13:00 -04:00
vaultwarden.loadBalancer.servers = [{url = "http://localhost:8222";}];
2023-05-28 22:00:50 -04:00
};
};
};
staticConfigOptions = {
log.level = "DEBUG";
api.dashboard = false;
api.insecure = false;
global = {
checkNewVersion = false;
sendAnonymousUsage = false;
};
entryPoints = {
2023-06-13 03:59:30 -04:00
websecure = {
address = ":443";
};
web = {
address = ":80";
forwardedHeaders.insecure = true;
2023-06-13 03:59:30 -04:00
};
2023-05-28 22:00:50 -04:00
};
2023-06-19 18:43:32 -04:00
metrics = {
prometheus = {
addServicesLabels = true;
};
};
2023-05-28 22:00:50 -04:00
certificatesResolvers = {
staging.acme = {
email = "x3xr6n66@notohh.dev";
storage = "/var/lib/traefik/acme.json";
caServer = "https://acme-staging-v02.api.letsencrypt.org/directory";
dnsChallenge = {
provider = "cloudflare";
resolvers = ["1.1.1.1:53" "1.0.0.1:53"];
delayBeforeCheck = "0";
};
};
production.acme = {
email = "x3xr6n66@notohh.dev";
storage = "/var/lib/traefik/acme.json";
caServer = "https://acme-v02.api.letsencrypt.org/directory";
dnsChallenge = {
provider = "cloudflare";
resolvers = ["1.1.1.1:53" "1.0.0.1:53"];
delayBeforeCheck = "0";
};
};
};
};
};
}