Blunkall-Technologies/Olympus
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

traefik ssl and sops-nix

Browse Source
This commit is contained in:
blaknull
2024-11-02 18:17:27 -05:00
parent 98b6f41547
commit 72a8dba440
8 changed files with 170 additions and 44 deletions
Download Patch File Download Diff File Expand all files Collapse all files

136
system-config/services/containers/traefik/default.nix
View File

@@ -30,14 +30,10 @@
containerPort = 9443;
hostPort = 9443;
}
{
containerPort = 8080;
hostPort = 8080;
}
];
bindMounts = {
"/root/data" = {
"/etc/traefik/data" = {
hostPath = "/ssd1/Traefik/data";
isReadOnly = false;
};
@@ -49,58 +45,144 @@
enable = true;
dataDir = "/root/data";
dataDir = "/etc/traefik/data";
environmentFiles = [
"/etc/traefik/data/traefik.env"
];
staticConfigOptions = {
serversTransport.insecureSkipVerify = true;
api = {
dashboard = true;
insecure = true;
debug = true;
};
global = {
checknewversion = false;
sendanonymoususage = false;
};
entryPoints = {
local = {
address = ":80";
address = ":9080";
http.redirections.entryPoint = {
to = "localsecure";
scheme = "https";
};
};
localsecure = {
address = ":443";
address = ":9443";
asDefault = true;
http.tls.certResolver = "cloudflare";
};
web = {
address = ":9080";
address = ":80";
http.redirections.entryPoint = {
to = "websecure";
scheme = "https";
};
};
websecure = {
address = ":9443";
address = ":443";
asDefault = true;
http.tls.certResolver = "letsencrypt";
http.tls.certResolver = "cloudflare";
};
log = {
level = "INFO";
filePath = "${config.services.traefik.dataDir}/traefik.log";
format = "json";
};
certificatesResolvers.cloudflare.acme = {
email = "nathanblunkall5@gmail.com";
storage = "${config.services.traefik.dataDir}/acme.json";
#httpChallenge.entryPoint = "web";
dnsChallenge = {
provider = "cloudflare";
resolvers = [ "1.1.1.1:53" "1.0.0.1:53" ];
#disablePropagationCheck = true;
};
log = {
level = "DEBUG";
filePath = "/etc/traefik/data/traefik.log";
format = "json";
};
certificatesResolvers = {
cloudflare = {
acme = {
email = "nathanblunkall5@gmail.com";
storage = "/etc/traefik/data/acme.json";
keyType = "EC256";
dnsChallenge = {
provider = "cloudflare";
resolvers = [ "1.1.1.1:53" "1.0.0.1:53" ];
};
};
};
/*letsencrypt.acme = {
email = "postmaster@blunkall.us";
storage = "/root/data/acme.json";
httpChallenge.entryPoint = "web";
};*/
};
};
dynamicConfigOptions = {};
dynamicConfigOptions = {
http = {
routers = {
homepageSecure = {
entryPoints = [ "localsecure" "websecure" ];
rule = "Host(`blunkall.us`)";
service = "homepage";
tls = {
certResolver = "cloudflare";
domains = {
main = "blunkall.us";
sans = [ "*.blunkall.us" "*.local.blunkall.us" ];
};
};
};
homepage = {
entryPoints = [ "localsecure" "websecure" ];
rule = "Host(`www.blunkall.us`)";
service = "homepage";
tls = {
certResolver = "cloudflare";
domains = {
main = "blunkall.us";
sans = [ "*.blunkall.us" "*.local.blunkall.us" ];
};
};
};
gitlab = {
entryPoints = [ "localsecure" "websecure" ];
rule = "Host()";
service = "gitlab";
tls = {
certResolver = "cloudflare";
domains = {
main = "blunkall.us";
sans = [ "*.blunkall.us" "*.local.blunkall.us" ];
};
};
};
local = {
entryPoints = [ "localsecure" ];
rule = "Host(`traefik.local.blunkall.us`)";
service = "dashboard@internal";
tls = {
certResolver = "cloudflare";
domains = {
main = "blunkall.us";
sans = [ "*.blunkall.us" "*.local.blunkall.us" ];
};
};
};
};
services = {
gitlab.loadBalancer.servers = [ { url = "http://192.168.100.12:80"; } ];
homepage.loadBalancer.servers = [ { url = "http://192.168.100.10:8000"; } ];
};
};
};
};
networking.firewall.allowedTCPPorts = [ 80 443 9080 9443 8080];
networking.firewall.allowedTCPPorts = [ 80 443 9080 9443 8080 ];
system.stateVersion = "24.05";
};