nki/nix-home
1
0
Fork 0
Code Issues Pull requests 1 Projects Releases Packages Wiki Activity

Add cert-resolver

Browse source
This commit is contained in:
Natsu Kagami 2021-11-01 15:50:30 -04:00
parent 0842bd53a2
commit 071889c976
Signed by: nki
GPG key ID: 7306B3D3C3AD6E51
7 changed files with 475 additions and 37 deletions
Download patch file Download diff file Expand all files Collapse all files

13
modules/cloud/traefik/default.nix
View file

@ -21,7 +21,7 @@ let
cfg = config.cloud.traefik;
in
{
imports = [ ./config.nix ./dashboard.nix ];
imports = [ ./config.nix ./dashboard.nix ./certs-dumper.nix ];
options.cloud.traefik = {
cloudflareKeyFile = mkOption {
type = types.path;
@ -33,6 +33,12 @@ in
default = {};
description = "The dynamic configuration to be passed to traefik";
};
certsPath = mkOption {
type = types.str;
default = "/var/lib/traefik/acme.json";
description = "The location to read and write the certificates file onto";
};
};
config.services.traefik = {
@ -52,6 +58,7 @@ in
## IMAP and SMTP
entrypoints.imap.address = ":993";
entrypoints.smtp-submission.address = ":587";
entrypoints.smtp-submission-ssl.address = ":465";
# Logging
# -------
@ -62,7 +69,7 @@ in
# ------------------
certificatesResolvers.le.acme = {
email = "natsukagami@gmail.com";
storage = "/var/lib/traefik/acme.json";
storage = cfg.certsPath;
dnsChallenge.provider = "cloudflare";
dnsChallenge.delayBeforeCheck = 10;
};
@ -74,6 +81,6 @@ in
config.systemd.services.traefik.environment.CF_DNS_API_TOKEN_FILE = cfg.cloudflareKeyFile;
# Set up firewall to allow traefik traffic.
config.networking.firewall.allowedTCPPorts = [ 80 443 993 587 ];
config.networking.firewall.allowedTCPPorts = [ 80 443 993 587 465 ];
config.networking.firewall.allowedUDPPorts = [ 443 ]; # QUIC
}