{config, ...}: { sops.secrets.cloudflare-api-key = {}; networking.firewall.allowedTCPPorts = [80 443 2222 8080]; systemd.services.traefik = { environment = { CLOUDFLARE_EMAIL = "jch0tm2e@notohh.dev"; }; serviceConfig = { EnvironmentFile = [config.sops.secrets.cloudflare-api-key.path]; }; }; services.traefik = { enable = true; dynamicConfigOptions = { tcp = { routers = { gitssh = { rule = "HostSNI(`*`)"; entrypoints = ["gitssh"]; service = "gitssh"; }; }; }; http = { middlewares = { authelia = { forwardauth = { address = "http://100.121.201.47:9091/api/verify?rd=https://passport.notohh.dev/"; trustForwardHeader = true; }; }; redirect-to-https = { redirectscheme.scheme = "https"; redirectscheme.permanent = true; }; cors = { headers = { accessControlAllowOriginList = "https://daphbot.notohh.dev"; }; }; }; routers = { api = { rule = "PathPrefix(`/api/`)"; entrypoints = ["websecure"]; service = "api@internal"; }; uptime-kuma-insecure = { rule = "Host(`status.flake.sh`)"; entrypoints = ["web"]; service = "uptime-kuma"; middlewares = "redirect-to-https"; }; uptime-kuma = { rule = "Host(`status.flake.sh`)"; entrypoints = ["websecure"]; service = "uptime-kuma"; tls.domains = [{main = "*.flake.sh";}]; tls.certresolver = "production"; }; gotify-insecure = { rule = "Host(`gotify.flake.sh`)"; entrypoints = ["web"]; service = "gotify"; middlewares = "redirect-to-https"; }; gotify = { rule = "Host(`gotify.flake.sh`)"; entrypoints = ["websecure"]; service = "gotify"; tls.domains = [{main = "*.flake.sh";}]; tls.certresolver = "production"; }; conduit-insecure = { rule = "Host(`matrix.flake.sh`)"; entrypoints = ["web"]; service = "conduit"; middlewares = "redirect-to-https"; }; conduit = { rule = "Host(`matrix.flake.sh`)"; entrypoints = ["websecure"]; service = "conduit"; tls.domains = [{main = "*.flake.sh";}]; tls.certresolver = "production"; }; authelia-insecure = { rule = "Host(`passport.notohh.dev`)"; entrypoints = ["web"]; service = "authelia"; middlewares = "redirect-to-https"; }; authelia = { rule = "Host(`passport.notohh.dev`)"; entrypoints = ["websecure"]; service = "authelia"; tls.domains = [{main = "*.notohh.dev";}]; tls.certresolver = "production"; }; foundryvtt-insecure = { rule = "Host(`foundry.flake.sh`)"; entrypoints = ["web"]; service = "authelia"; middlewares = "redirect-to-https"; }; foundryvtt = { rule = "Host(`foundry.flake.sh`)"; entrypoints = ["websecure"]; service = "foundryvtt"; tls.domains = [{main = "*.flake.sh";}]; tls.certresolver = "production"; }; forgejo-insecure = { rule = "Host(`git.flake.sh`)"; entrypoints = ["web"]; service = "forgejo"; middlewares = "redirect-to-https"; }; forgejo = { rule = "Host(`git.flake.sh`)"; entrypoints = ["websecure"]; service = "forgejo"; tls.domains = [{main = "*.flake.sh";}]; tls.certresolver = "production"; middlewares = "cors"; }; rustypaste-insecure = { rule = "Host(`i.flake.sh`)"; entrypoints = ["web"]; service = "rustypaste"; middlewares = "redirect-to-https"; }; rustypaste = { rule = "Host(`i.flake.sh`)"; entrypoints = ["websecure"]; service = "rustypaste"; tls.domains = [{main = "*.flake.sh";}]; tls.certresolver = "production"; }; grafana-insecure = { rule = "Host(`metrics.flake.sh`)"; entrypoints = ["web"]; service = "grafana"; middlewares = "redirect-to-https"; }; grafana = { rule = "Host(`metrics.flake.sh`)"; entrypoints = ["websecure"]; service = "grafana"; tls.domains = [{main = "*.flake.sh";}]; tls.certresolver = "production"; }; hedgedoc-insecure = { rule = "Host(`scratch.flake.sh`)"; entrypoints = ["web"]; service = "hedgedoc"; middlewares = "redirect-to-https"; }; hedgedoc = { rule = "Host(`scratch.flake.sh`)"; entrypoints = ["websecure"]; service = "hedgedoc"; tls.domains = [{main = "*.flake.sh";}]; tls.certresolver = "production"; }; vaultwarden-insecure = { rule = "Host(`vault.flake.sh`)"; entrypoints = ["web"]; service = "vaultwarden"; middlewares = "redirect-to-https"; }; vaultwarden = { rule = "Host(`vault.flake.sh`)"; entrypoints = ["websecure"]; service = "vaultwarden"; tls.domains = [{main = "*.flake.sh";}]; tls.certresolver = "production"; }; searxng-insecure = { rule = "Host(`search.flake.sh`)"; entrypoints = ["web"]; service = "searxng"; middlewares = "redirect-to-https"; }; searxng = { rule = "Host(`search.flake.sh`)"; entrypoints = ["websecure"]; service = "searxng"; tls.domains = [{main = "*.flake.sh";}]; tls.certresolver = "production"; }; }; services = { gitssh.loadBalancer.servers = [{url = "tcp://100.121.201.47:2222";}]; uptime-kuma.loadBalancer.servers = [{url = "http://100.87.54.48:4000";}]; gotify.loadBalancer.servers = [{url = "http://100.87.54.48:3000";}]; conduit.loadBalancer.servers = [{url = "http://100.121.201.47:6167";}]; authelia.loadBalancer.servers = [{url = "http://100.121.201.47:9091";}]; foundryvtt.loadBalancer.servers = [{url = "http://100.121.201.47:30000";}]; forgejo.loadBalancer.servers = [{url = "http://100.121.201.47:3200";}]; rustypaste.loadBalancer.servers = [{url = "http://100.121.201.47:8000";}]; grafana.loadBalancer.servers = [{url = "http://100.121.201.47:3100";}]; hedgedoc.loadBalancer.servers = [{url = "http://100.121.201.47:3300";}]; vaultwarden.loadBalancer.servers = [{url = "http://100.121.201.47:8222";}]; searxng.loadBalancer.servers = [{url = "http://100.121.201.47:8100";}]; }; }; }; staticConfigOptions = { log.level = "DEBUG"; api.dashboard = true; api.insecure = false; global = { checkNewVersion = false; sendAnonymousUsage = false; }; entryPoints = { websecure = { address = ":443"; }; web = { address = ":80"; }; gitssh = { address = ":2222"; }; }; metrics = { prometheus = { addServicesLabels = true; }; }; certificatesResolvers = { staging.acme = { email = "x3xr6n66@notohh.dev"; storage = "/var/lib/traefik/acme.json"; caServer = "https://acme-staging-v02.api.letsencrypt.org/directory"; dnsChallenge = { provider = "cloudflare"; resolvers = ["1.1.1.1:53" "1.0.0.1:53"]; delayBeforeCheck = "0"; }; }; production.acme = { email = "x3xr6n66@notohh.dev"; storage = "/var/lib/traefik/acme.json"; caServer = "https://acme-v02.api.letsencrypt.org/directory"; dnsChallenge = { provider = "cloudflare"; resolvers = ["1.1.1.1:53" "1.0.0.1:53"]; delayBeforeCheck = "0"; }; }; }; }; }; }