2023-06-11 18:19:51 -04:00
|
|
|
{config, ...}: {
|
2023-05-28 22:00:50 -04:00
|
|
|
sops.secrets.cloudflare-api-key = {};
|
2023-06-19 18:43:32 -04:00
|
|
|
networking.firewall.allowedTCPPorts = [80 443 8080];
|
2023-05-28 22:00:50 -04:00
|
|
|
systemd.services.traefik = {
|
|
|
|
environment = {
|
|
|
|
CLOUDFLARE_EMAIL = "jch0tm2e@notohh.dev";
|
|
|
|
};
|
2023-06-11 18:19:51 -04:00
|
|
|
serviceConfig = {
|
|
|
|
EnvironmentFile = [config.sops.secrets.cloudflare-api-key.path];
|
|
|
|
};
|
2023-05-28 22:00:50 -04:00
|
|
|
};
|
|
|
|
services.traefik = {
|
|
|
|
enable = true;
|
|
|
|
dynamicConfigOptions = {
|
2023-06-19 18:43:32 -04:00
|
|
|
http.middlewares.authelia = {
|
|
|
|
forwardauth = {
|
|
|
|
address = "http://localhost:9091/api/verify?rd=https://passport.notohh.dev/";
|
|
|
|
trustForwardHeader = true;
|
|
|
|
};
|
|
|
|
};
|
2023-05-28 22:00:50 -04:00
|
|
|
http = {
|
|
|
|
routers = {
|
|
|
|
api = {
|
|
|
|
rule = "PathPrefix(`/api/`)";
|
|
|
|
entryPoints = ["websecure"];
|
|
|
|
service = "api@internal";
|
|
|
|
};
|
|
|
|
jellyfin = {
|
2023-06-11 07:50:58 -04:00
|
|
|
rule = "Host(`jellyfin.home.arpa`)";
|
2023-05-28 22:00:50 -04:00
|
|
|
entrypoints = ["web"];
|
|
|
|
service = "jellyfin";
|
|
|
|
};
|
2023-06-14 04:44:31 -04:00
|
|
|
jellyseerr = {
|
|
|
|
rule = "Host(`jellyseerr.home.arpa`)";
|
|
|
|
entrypoints = ["web"];
|
|
|
|
service = "jellyseerr";
|
|
|
|
};
|
2023-06-14 02:59:32 -04:00
|
|
|
dashdot = {
|
|
|
|
rule = "Host(`dashdot.sakura.home.arpa`)";
|
|
|
|
entrypoints = ["web"];
|
|
|
|
service = "dashdot";
|
|
|
|
};
|
2023-06-19 18:43:32 -04:00
|
|
|
authelia = {
|
|
|
|
rule = "Host(`passport.notohh.dev`)";
|
|
|
|
entrypoints = ["websecure"];
|
|
|
|
service = "authelia";
|
|
|
|
tls.domains = [{main = "*.notohh.dev";}];
|
|
|
|
tls.certresolver = "production";
|
|
|
|
};
|
2023-05-28 22:00:50 -04:00
|
|
|
hugo = {
|
|
|
|
rule = "Host(`notohh.dev`)";
|
2023-06-19 18:43:32 -04:00
|
|
|
entrypoints = ["websecure"];
|
2023-05-28 22:00:50 -04:00
|
|
|
service = "hugo";
|
|
|
|
tls.domains = [{main = "*.notohh.dev";}];
|
|
|
|
tls.certresolver = "production";
|
2023-06-19 18:43:32 -04:00
|
|
|
middlewares = "authelia";
|
2023-05-28 22:00:50 -04:00
|
|
|
};
|
|
|
|
foundryvtt = {
|
|
|
|
rule = "Host(`foundry.notohh.dev`)";
|
|
|
|
entrypoints = ["websecure"];
|
|
|
|
service = "foundryvtt";
|
|
|
|
tls.domains = [{main = "*.notohh.dev";}];
|
|
|
|
tls.certresolver = "production";
|
|
|
|
};
|
|
|
|
gitea = {
|
|
|
|
rule = "Host(`git.notohh.dev`)";
|
|
|
|
entrypoints = ["websecure"];
|
|
|
|
service = "gitea";
|
|
|
|
tls.domains = [{main = "*.notohh.dev";}];
|
|
|
|
tls.certresolver = "production";
|
|
|
|
};
|
|
|
|
rustypaste = {
|
|
|
|
rule = "Host(`img.notohh.dev`)";
|
|
|
|
entrypoints = ["websecure"];
|
|
|
|
service = "rustypaste";
|
|
|
|
tls.domains = [{main = "*.notohh.dev";}];
|
|
|
|
tls.certresolver = "production";
|
|
|
|
};
|
2023-06-06 00:08:22 -04:00
|
|
|
grafana = {
|
|
|
|
rule = "Host(`metrics.notohh.dev`)";
|
|
|
|
entrypoints = ["websecure"];
|
|
|
|
service = "grafana";
|
|
|
|
tls.domains = [{main = "*.notohh.dev";}];
|
|
|
|
tls.certresolver = "production";
|
|
|
|
};
|
2023-06-11 05:10:20 -04:00
|
|
|
woodpecker-server = {
|
|
|
|
rule = "Host(`ci.notohh.dev`)";
|
|
|
|
entrypoints = ["websecure"];
|
|
|
|
service = "woodpecker-server";
|
|
|
|
tls.domains = [{main = "*.notohh.dev";}];
|
|
|
|
tls.certresolver = "production";
|
|
|
|
};
|
2023-06-12 00:04:26 -04:00
|
|
|
atticd = {
|
|
|
|
rule = "Host(`cache.notohh.dev`)";
|
|
|
|
entrypoints = ["websecure"];
|
|
|
|
service = "atticd";
|
|
|
|
tls.domains = [{main = "*.notohh.dev";}];
|
|
|
|
tls.certresolver = "production";
|
|
|
|
};
|
2023-06-13 15:17:23 -04:00
|
|
|
hedgedoc = {
|
|
|
|
rule = "Host(`scratch.notohh.dev`)";
|
|
|
|
entrypoints = ["websecure"];
|
|
|
|
service = "hedgedoc";
|
|
|
|
tls.domains = [{main = "*.notohh.dev";}];
|
|
|
|
tls.certresolver = "production";
|
|
|
|
};
|
2023-05-28 22:00:50 -04:00
|
|
|
};
|
|
|
|
services = {
|
2023-06-19 18:43:32 -04:00
|
|
|
authelia.loadBalancer.servers = [{url = "http://localhost:9091";}];
|
2023-06-14 03:58:49 -04:00
|
|
|
dashdot.loadBalancer.servers = [{url = "http://localhost:4000";}];
|
2023-05-28 22:00:50 -04:00
|
|
|
hugo.loadBalancer.servers = [{url = "http://localhost:1313";}];
|
|
|
|
jellyfin.loadBalancer.servers = [{url = "http://localhost:8096";}];
|
2023-06-14 04:44:31 -04:00
|
|
|
jellyseerr.loadBalancer.servers = [{url = "http://localhost:5055";}];
|
2023-05-28 22:00:50 -04:00
|
|
|
foundryvtt.loadBalancer.servers = [{url = "http://localhost:30000";}];
|
2023-06-11 07:50:58 -04:00
|
|
|
gitea.loadBalancer.servers = [{url = "http://localhost:3200";}];
|
2023-05-28 22:00:50 -04:00
|
|
|
rustypaste.loadBalancer.servers = [{url = "http://localhost:8000";}];
|
2023-06-06 00:08:22 -04:00
|
|
|
grafana.loadBalancer.servers = [{url = "http://localhost:3100";}];
|
2023-06-12 00:04:26 -04:00
|
|
|
woodpecker-server.loadBalancer.servers = [{url = "http://localhost:8200";}];
|
|
|
|
atticd.loadBalancer.servers = [{url = "http://localhost:8100";}];
|
2023-06-13 15:17:23 -04:00
|
|
|
hedgedoc.loadBalancer.servers = [{url = "http://localhost:3300";}];
|
2023-05-28 22:00:50 -04:00
|
|
|
};
|
|
|
|
};
|
|
|
|
};
|
|
|
|
staticConfigOptions = {
|
|
|
|
log.level = "DEBUG";
|
|
|
|
api.dashboard = false;
|
|
|
|
api.insecure = false;
|
|
|
|
global = {
|
|
|
|
checkNewVersion = false;
|
|
|
|
sendAnonymousUsage = false;
|
|
|
|
};
|
|
|
|
entryPoints = {
|
2023-06-13 03:59:30 -04:00
|
|
|
websecure = {
|
|
|
|
address = ":443";
|
|
|
|
};
|
|
|
|
web = {
|
|
|
|
address = ":80";
|
2023-06-14 02:59:32 -04:00
|
|
|
forwardedHeaders.insecure = true;
|
2023-06-13 03:59:30 -04:00
|
|
|
};
|
2023-05-28 22:00:50 -04:00
|
|
|
};
|
2023-06-19 18:43:32 -04:00
|
|
|
metrics = {
|
|
|
|
prometheus = {
|
|
|
|
addServicesLabels = true;
|
|
|
|
};
|
|
|
|
};
|
2023-05-28 22:00:50 -04:00
|
|
|
certificatesResolvers = {
|
|
|
|
staging.acme = {
|
|
|
|
email = "x3xr6n66@notohh.dev";
|
|
|
|
storage = "/var/lib/traefik/acme.json";
|
|
|
|
caServer = "https://acme-staging-v02.api.letsencrypt.org/directory";
|
|
|
|
dnsChallenge = {
|
|
|
|
provider = "cloudflare";
|
|
|
|
resolvers = ["1.1.1.1:53" "1.0.0.1:53"];
|
|
|
|
delayBeforeCheck = "0";
|
|
|
|
};
|
|
|
|
};
|
|
|
|
production.acme = {
|
|
|
|
email = "x3xr6n66@notohh.dev";
|
|
|
|
storage = "/var/lib/traefik/acme.json";
|
|
|
|
caServer = "https://acme-v02.api.letsencrypt.org/directory";
|
|
|
|
dnsChallenge = {
|
|
|
|
provider = "cloudflare";
|
|
|
|
resolvers = ["1.1.1.1:53" "1.0.0.1:53"];
|
|
|
|
delayBeforeCheck = "0";
|
|
|
|
};
|
|
|
|
};
|
|
|
|
};
|
|
|
|
};
|
|
|
|
};
|
|
|
|
}
|