restructure
This commit is contained in:
75
modules/features/traefik/config/routing.yml
Normal file
75
modules/features/traefik/config/routing.yml
Normal file
@@ -0,0 +1,75 @@
|
||||
http:
|
||||
routers:
|
||||
|
||||
homepageSecure:
|
||||
entryPoints:
|
||||
- "websecure"
|
||||
- "localsecure"
|
||||
rule: "Host(`esotericbytes.com`) || Host(`www.esotericbytes.com`)"
|
||||
service: "homepage"
|
||||
middlewares:
|
||||
- authentik
|
||||
tls:
|
||||
certResolver: "cloudflare"
|
||||
|
||||
code-server:
|
||||
entryPoints:
|
||||
- "localsecure"
|
||||
rule: "Host(`code.esotericbytes.com`)"
|
||||
service: "code-server"
|
||||
tls:
|
||||
certResolver: "cloudflare"
|
||||
|
||||
gitea:
|
||||
entryPoints:
|
||||
- "localsecure"
|
||||
- "websecure"
|
||||
rule: "Host(`gitea.esotericbytes.com`)"
|
||||
service: "gitea"
|
||||
tls:
|
||||
certResolver: "cloudflare"
|
||||
|
||||
octoprint:
|
||||
entryPoints:
|
||||
- "localsecure"
|
||||
#- "websecure"
|
||||
rule: "Host(`3dp.esotericbytes.com`)"
|
||||
service: "octoprint"
|
||||
tls:
|
||||
certResolver: "cloudflare"
|
||||
|
||||
services:
|
||||
homepage:
|
||||
loadBalancer:
|
||||
servers:
|
||||
- url: "http://192.168.100.13:80"
|
||||
|
||||
code-server:
|
||||
loadBalancer:
|
||||
servers:
|
||||
- url: "http://192.168.100.31:4444"
|
||||
|
||||
gitea:
|
||||
loadBalancer:
|
||||
servers:
|
||||
- url: "http://192.168.100.20:3000"
|
||||
|
||||
octoprint:
|
||||
loadBalancer:
|
||||
servers:
|
||||
- url: "http://rpi-3dp.local"
|
||||
passHostHeader: true
|
||||
|
||||
tcp:
|
||||
routers:
|
||||
gitea-ssh:
|
||||
entryPoints:
|
||||
- "gitea-ssh"
|
||||
rule: "HostSNI(`*`)"
|
||||
service: "gitea-ssh"
|
||||
|
||||
services:
|
||||
gitea-ssh:
|
||||
loadBalancer:
|
||||
servers:
|
||||
- address: "192.168.100.20:2222"
|
||||
87
modules/features/traefik/config/traefik.yml
Normal file
87
modules/features/traefik/config/traefik.yml
Normal file
@@ -0,0 +1,87 @@
|
||||
providers:
|
||||
docker:
|
||||
exposedByDefault: false
|
||||
file:
|
||||
filename: "/etc/traefik/routing.yml"
|
||||
|
||||
serversTransport:
|
||||
insecureSkipVerify: true
|
||||
|
||||
api:
|
||||
dashboard: true
|
||||
|
||||
global:
|
||||
checknewversion: true
|
||||
sendanonymoususage: false
|
||||
|
||||
entryPoints:
|
||||
web:
|
||||
address: ":81"
|
||||
http:
|
||||
redirections:
|
||||
entryPoint:
|
||||
to: "websecure"
|
||||
scheme: "https"
|
||||
|
||||
websecure:
|
||||
address: ":444"
|
||||
asDefault: true
|
||||
transport:
|
||||
respondingTimeouts:
|
||||
readTimeout: 24h
|
||||
http:
|
||||
tls:
|
||||
certResolver: "cloudflare"
|
||||
domains:
|
||||
main: "esotericbytes.com"
|
||||
sans:
|
||||
- "*.esotericbytes.com"
|
||||
encodedCharacters:
|
||||
allowEncodedSlash: true
|
||||
allowEncodedQuestionMark: true
|
||||
allowEncodedPercent: true
|
||||
|
||||
local:
|
||||
address: ":80"
|
||||
http:
|
||||
redirections:
|
||||
entryPoint:
|
||||
to: "localsecure"
|
||||
scheme: "https"
|
||||
|
||||
localsecure:
|
||||
address: ":443"
|
||||
asDefault: true
|
||||
transport:
|
||||
respondingTimeouts:
|
||||
readTimeout: 24h
|
||||
http:
|
||||
tls:
|
||||
certResolver: "cloudflare"
|
||||
domains:
|
||||
main: "esotericbytes.com"
|
||||
sans:
|
||||
- "*.esotericbytes.com"
|
||||
encodedCharacters:
|
||||
allowEncodedSlash: true
|
||||
allowEncodedQuestionMark: true
|
||||
allowEncodedPercent: true
|
||||
gitea-ssh:
|
||||
address: ":2222"
|
||||
|
||||
log:
|
||||
level: "INFO"
|
||||
filePath: "/etc/traefik/logs/traefik.log"
|
||||
format: "json"
|
||||
|
||||
certificatesResolvers:
|
||||
cloudflare:
|
||||
acme:
|
||||
storage: "/etc/traefik/acme.json"
|
||||
keyType: "EC256"
|
||||
dnsChallenge:
|
||||
provider: "cloudflare"
|
||||
resolvers:
|
||||
- "1.1.1.1:53"
|
||||
- "1.0.0.1:53"
|
||||
|
||||
111
modules/features/traefik/traefik.nix
Normal file
111
modules/features/traefik/traefik.nix
Normal file
@@ -0,0 +1,111 @@
|
||||
{ ... }: {
|
||||
|
||||
flake.nixosModules.default = { config, lib, ... }: {
|
||||
|
||||
options.sysconfig.docker.traefik.enable = with lib; mkOption {
|
||||
type = with types; bool;
|
||||
default = false;
|
||||
};
|
||||
|
||||
config = lib.mkIf (config.sysconfig.docker.traefik.enable && config.sysconfig.docker.enable) {
|
||||
|
||||
networking.firewall.allowedTCPPorts = [ 80 81 443 444 2222 ];
|
||||
|
||||
sops.secrets = {
|
||||
"traefik/cf_email" = {};
|
||||
"traefik/cf_api_key" = {};
|
||||
};
|
||||
|
||||
sops.templates."traefik.env" = {
|
||||
content = ''
|
||||
CF_API_EMAIL=${config.sops.placeholder."traefik/cf_email"}
|
||||
CF_DNS_API_TOKEN=${config.sops.placeholder."traefik/cf_api_key"}
|
||||
'';
|
||||
};
|
||||
|
||||
environment.etc = (builtins.listToAttrs (builtins.map (x: {
|
||||
name = "traefik/${x}";
|
||||
value = {
|
||||
source = ./config/${x};
|
||||
mode = "0664";
|
||||
};
|
||||
}) (builtins.attrNames (builtins.readDir ./config))));
|
||||
|
||||
/*environment.etc."traefik/traefik.yml" = {
|
||||
source = ./config/traefik.yml;
|
||||
};
|
||||
environment.etc."traefik/routing.yml" = {
|
||||
source = ./config/routing.yml;
|
||||
};*/
|
||||
|
||||
virtualisation.oci-containers.containers.traefik = {
|
||||
|
||||
image = "traefik:v3.6";
|
||||
|
||||
environment = {
|
||||
TRAEFIK_CERTIFICATESRESOLVERS_CLOUDFLARE_ACME_EMAIL = "\${CF_API_EMAIL}";
|
||||
};
|
||||
|
||||
environmentFiles = [ config.sops.templates."traefik.env".path ];
|
||||
|
||||
volumes = [
|
||||
"/etc/traefik/:/etc/traefik/"
|
||||
"/run/docker.sock:/var/run/docker.sock"
|
||||
];
|
||||
|
||||
networks = [
|
||||
"docker-main"
|
||||
];
|
||||
|
||||
ports = [
|
||||
"80:80"
|
||||
"81:81"
|
||||
"443:443"
|
||||
"444:444"
|
||||
"2222:2222"
|
||||
];
|
||||
|
||||
labels = {
|
||||
"traefik.enable" = "true";
|
||||
"traefik.http.routers.dashboard.rule" = "Host(`traefik.esotericbytes.com`)";
|
||||
"traefik.http.routers.dashboard.entrypoints" = "websecure,localsecure";
|
||||
"traefik.http.routers.dashboard.service" = "api@internal";
|
||||
"traefik.http.routers.dashboard.tls.certResolver" = "cloudflare";
|
||||
};
|
||||
|
||||
extraOptions = [
|
||||
"--ip=192.168.101.11"
|
||||
];
|
||||
|
||||
log-driver = "journald";
|
||||
};
|
||||
systemd.services."docker-traefik" = {
|
||||
serviceConfig = {
|
||||
Restart = lib.mkOverride 90 "always";
|
||||
RestartMaxDelaySec = lib.mkOverride 90 "1m";
|
||||
RestartSec = lib.mkOverride 90 "100ms";
|
||||
RestartSteps = lib.mkOverride 90 9;
|
||||
};
|
||||
after = [
|
||||
"docker-network-setup.service"
|
||||
];
|
||||
requires = [
|
||||
"docker-network-setup.service"
|
||||
];
|
||||
partOf = [
|
||||
"docker-compose-traefik-root.target"
|
||||
];
|
||||
wantedBy = [
|
||||
"docker-compose-traefik-root.target"
|
||||
];
|
||||
};
|
||||
|
||||
# Root service
|
||||
# When started, this will automatically create all resources and start
|
||||
# the containers. When stopped, this will teardown all resources.
|
||||
systemd.targets."docker-compose-traefik-root" = {
|
||||
wantedBy = [ "multi-user.target" ];
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
Reference in New Issue
Block a user