snowflake/hosts/sora/services/traefik.nix

210 lines
6.9 KiB
Nix
Raw Normal View History

2023-06-24 19:11:16 -04:00
{config, ...}: {
sops.secrets.cloudflare-api-key = {};
2023-10-17 00:48:08 -04:00
networking.firewall.allowedTCPPorts = [80 443 2222 8080];
2023-06-24 19:11:16 -04:00
systemd.services.traefik = {
environment = {
CLOUDFLARE_EMAIL = "jch0tm2e@notohh.dev";
};
serviceConfig = {
EnvironmentFile = [config.sops.secrets.cloudflare-api-key.path];
};
};
services.traefik = {
enable = true;
dynamicConfigOptions = {
2023-10-07 17:06:51 -04:00
tcp = {
routers = {
gitssh = {
rule = "HostSNI(`*`)";
2023-12-29 14:27:17 -05:00
entrypoints = ["ssh"];
2023-10-07 17:06:51 -04:00
service = "gitssh";
};
};
2023-12-29 14:27:17 -05:00
services = {
gitssh.loadBalancer.servers = [{address = "100.121.201.47:2222";}];
};
2023-10-07 17:06:51 -04:00
};
2023-06-24 19:11:16 -04:00
http = {
2023-10-12 02:16:22 -04:00
middlewares = {
authelia = {
forwardauth = {
address = "http://100.121.201.47:9091/api/verify?rd=https://passport.notohh.dev/";
trustForwardHeader = true;
};
};
redirect-to-https = {
redirectscheme.scheme = "https";
redirectscheme.permanent = true;
2023-06-24 19:11:16 -04:00
};
2023-10-27 12:33:05 -04:00
cors = {
headers = {
accessControlAllowOriginList = "https://daphbot.notohh.dev";
};
};
2023-06-24 19:11:16 -04:00
};
routers = {
api = {
rule = "PathPrefix(`/api/`)";
entrypoints = ["websecure"];
service = "api@internal";
};
uptime-kuma = {
2023-10-03 14:24:26 -04:00
rule = "Host(`status.flake.sh`)";
2023-06-24 19:11:16 -04:00
entrypoints = ["websecure"];
service = "uptime-kuma";
2023-10-03 14:24:26 -04:00
tls.domains = [{main = "*.flake.sh";}];
2023-06-24 19:11:16 -04:00
tls.certresolver = "production";
};
2023-09-25 12:49:20 -04:00
conduit = {
2023-10-03 14:24:26 -04:00
rule = "Host(`matrix.flake.sh`)";
2023-09-25 12:49:20 -04:00
entrypoints = ["websecure"];
service = "conduit";
2023-10-03 14:24:26 -04:00
tls.domains = [{main = "*.flake.sh";}];
2023-09-25 12:49:20 -04:00
tls.certresolver = "production";
};
2023-10-04 21:49:22 -04:00
authelia = {
rule = "Host(`passport.notohh.dev`)";
entrypoints = ["websecure"];
service = "authelia";
tls.domains = [{main = "*.notohh.dev";}];
tls.certresolver = "production";
};
foundryvtt = {
rule = "Host(`foundry.flake.sh`)";
entrypoints = ["websecure"];
service = "foundryvtt";
tls.domains = [{main = "*.flake.sh";}];
tls.certresolver = "production";
};
forgejo = {
rule = "Host(`git.flake.sh`)";
entrypoints = ["websecure"];
service = "forgejo";
tls.domains = [{main = "*.flake.sh";}];
tls.certresolver = "production";
2023-10-27 12:33:05 -04:00
middlewares = "cors";
};
rustypaste = {
rule = "Host(`i.flake.sh`)";
entrypoints = ["websecure"];
service = "rustypaste";
tls.domains = [{main = "*.flake.sh";}];
tls.certresolver = "production";
};
grafana = {
rule = "Host(`metrics.flake.sh`)";
entrypoints = ["websecure"];
service = "grafana";
tls.domains = [{main = "*.flake.sh";}];
tls.certresolver = "production";
};
hedgedoc = {
rule = "Host(`scratch.flake.sh`)";
entrypoints = ["websecure"];
service = "hedgedoc";
tls.domains = [{main = "*.flake.sh";}];
tls.certresolver = "production";
};
vaultwarden = {
rule = "Host(`vault.flake.sh`)";
entrypoints = ["websecure"];
service = "vaultwarden";
tls.domains = [{main = "*.flake.sh";}];
tls.certresolver = "production";
};
2023-11-30 10:54:55 -05:00
neko = {
rule = "Host(`neko.flake.sh`)";
entrypoints = ["websecure"];
service = "neko";
tls.domains = [{main = "*.flake.sh";}];
tls.certresolver = "production";
};
2023-12-15 08:28:33 -05:00
justlog = {
rule = "Host(`logs.flake.sh`)";
entrypoints = ["websecure"];
service = "justlog";
tls.domains = [{main = "*.flake.sh";}];
tls.certresolver = "production";
};
2023-12-30 18:02:40 -05:00
ntfy = {
rule = "Host(`ntfy.flake.sh`)";
entrypoints = ["websecure"];
service = "ntfy-sh";
tls.domains = [{main = "*.flake.sh";}];
tls.certresolver = "production";
};
2023-06-24 19:11:16 -04:00
};
services = {
2023-12-30 13:38:19 -05:00
forgejo.loadBalancer = {
passHostHeader = true;
servers = [{url = "http://100.121.201.47:3200";}];
};
2023-11-30 14:55:40 -05:00
uptime-kuma.loadBalancer.servers = [{url = "http://100.104.42.96:4000";}];
2023-09-28 17:06:50 -04:00
conduit.loadBalancer.servers = [{url = "http://100.121.201.47:6167";}];
2023-10-04 21:49:22 -04:00
authelia.loadBalancer.servers = [{url = "http://100.121.201.47:9091";}];
foundryvtt.loadBalancer.servers = [{url = "http://100.121.201.47:30000";}];
rustypaste.loadBalancer.servers = [{url = "http://100.121.201.47:8000";}];
grafana.loadBalancer.servers = [{url = "http://100.121.201.47:3100";}];
hedgedoc.loadBalancer.servers = [{url = "http://100.121.201.47:3300";}];
vaultwarden.loadBalancer.servers = [{url = "http://100.121.201.47:8222";}];
2023-10-16 23:14:43 -04:00
searxng.loadBalancer.servers = [{url = "http://100.121.201.47:8100";}];
2023-11-30 10:54:55 -05:00
neko.loadBalancer.servers = [{url = "http://100.104.42.96:8085";}];
2023-12-15 08:28:33 -05:00
justlog.loadBalancer.servers = [{url = "http://100.121.201.47:8025";}];
2023-12-30 18:02:40 -05:00
ntfy-sh.loadBalancer.servers = [{url = "http://100.104.42.96:8090";}];
2023-06-24 19:11:16 -04:00
};
};
};
staticConfigOptions = {
log.level = "DEBUG";
2023-10-17 00:48:08 -04:00
api.dashboard = true;
2023-11-11 16:28:21 -05:00
api.insecure = true;
2023-06-24 19:11:16 -04:00
global = {
checkNewVersion = false;
sendAnonymousUsage = false;
};
entryPoints = {
websecure = {
address = ":443";
};
web = {
address = ":80";
2023-12-29 15:03:46 -05:00
http.redirections.entryPoint = {
to = "websecure";
scheme = "https";
};
2023-06-24 19:11:16 -04:00
};
2023-12-29 14:27:17 -05:00
ssh = {
2023-10-07 17:06:51 -04:00
address = ":2222";
};
2023-06-24 19:11:16 -04:00
};
metrics = {
prometheus = {
addServicesLabels = true;
};
};
certificatesResolvers = {
staging.acme = {
email = "x3xr6n66@notohh.dev";
storage = "/var/lib/traefik/acme.json";
caServer = "https://acme-staging-v02.api.letsencrypt.org/directory";
dnsChallenge = {
provider = "cloudflare";
resolvers = ["1.1.1.1:53" "1.0.0.1:53"];
delayBeforeCheck = "0";
};
};
production.acme = {
email = "x3xr6n66@notohh.dev";
storage = "/var/lib/traefik/acme.json";
caServer = "https://acme-v02.api.letsencrypt.org/directory";
dnsChallenge = {
provider = "cloudflare";
resolvers = ["1.1.1.1:53" "1.0.0.1:53"];
delayBeforeCheck = "0";
};
};
};
};
};
}