nix-home/modules/cloud/traefik/default.nix

89 lines
2.2 KiB
Nix
Raw Normal View History

2022-05-31 16:45:33 +00:00
{ pkgs, config, lib, ... }:
2021-10-31 21:37:04 +00:00
with lib;
let
# Copied from traefik.nix
jsonValue = with types;
let
2022-05-31 16:45:33 +00:00
valueType = nullOr
(oneOf [
bool
int
float
str
(lazyAttrsOf valueType)
(listOf valueType)
]) // {
2021-10-31 21:37:04 +00:00
description = "JSON value";
emptyValue.value = { };
};
2022-05-31 16:45:33 +00:00
in
valueType;
2021-10-31 21:37:04 +00:00
cfg = config.cloud.traefik;
in
{
2021-11-01 19:50:30 +00:00
imports = [ ./config.nix ./dashboard.nix ./certs-dumper.nix ];
2021-10-31 21:37:04 +00:00
options.cloud.traefik = {
cloudflareKeyFile = mkOption {
type = types.path;
description = "The cloudflake private key file, for Let's Encrypt DNS challenge";
};
config = mkOption {
type = jsonValue;
2022-05-31 16:45:33 +00:00
default = { };
2021-10-31 21:37:04 +00:00
description = "The dynamic configuration to be passed to traefik";
};
2021-11-01 19:50:30 +00:00
certsPath = mkOption {
type = types.str;
default = "/var/lib/traefik/acme.json";
description = "The location to read and write the certificates file onto";
};
2021-10-31 21:37:04 +00:00
};
2022-05-31 16:45:33 +00:00
2021-10-31 21:37:04 +00:00
config.services.traefik = {
enable = true;
staticConfigOptions = {
# Entrypoints
# ------------
## HTTP entrypoint: always redirect to 443
entrypoints.http.address = ":80";
entrypoints.http.http.redirections.entryPoint = {
to = "https";
scheme = "https";
};
## HTTPS entrypoint: ok!
entrypoints.https.address = ":443";
## IMAP and SMTP
entrypoints.imap.address = ":993";
entrypoints.smtp-submission.address = ":587";
2021-11-01 19:50:30 +00:00
entrypoints.smtp-submission-ssl.address = ":465";
2021-10-31 21:37:04 +00:00
# Logging
# -------
2022-05-31 16:45:33 +00:00
accessLog = { };
2021-10-31 21:37:04 +00:00
log.level = "info";
# ACME Automatic SSL
# ------------------
certificatesResolvers.le.acme = {
email = "natsukagami@gmail.com";
2021-11-01 19:50:30 +00:00
storage = cfg.certsPath;
2021-10-31 21:37:04 +00:00
dnsChallenge.provider = "cloudflare";
dnsChallenge.delayBeforeCheck = 10;
};
};
2021-11-01 01:41:29 +00:00
dynamicConfigOptions = cfg.config;
2021-10-31 21:37:04 +00:00
};
# Set up cloudflare key
config.systemd.services.traefik.environment.CF_DNS_API_TOKEN_FILE = cfg.cloudflareKeyFile;
# Set up firewall to allow traefik traffic.
2021-11-01 19:50:30 +00:00
config.networking.firewall.allowedTCPPorts = [ 80 443 993 587 465 ];
2021-10-31 21:37:04 +00:00
config.networking.firewall.allowedUDPPorts = [ 443 ]; # QUIC
}