Add dashboard support

modules/cloud/traefik/config.nix

@@ -46,7 +46,7 @@ let
         description = "The entrypoints that will serve the host";
       };
       middlewares = mkOption {
-        type = listOf jsonType;
+        type = listOf jsonValue;
         default = [];
         description = "The middlewares to be used with the host.";
       };

modules/cloud/traefik/dashboard.nix

@@ -0,0 +1,40 @@
+{ pkgs, config, lib, ... }:
+
+with lib;
+let
+  cfg = config.cloud.traefik.dashboard;
+in
+{
+  options.cloud.traefik.dashboard = {
+    enable = mkEnableOption "Enables the Traefik Dashboard";
+    usersFile = mkOption {
+      type = types.path;
+      description = ''
+        The path to the users authentication file.
+        This is passed to the basicAuth middleware, see https://doc.traefik.io/traefik/middlewares/http/basicauth/
+      '';
+    };
+    host = mkOption {
+      type = types.str;
+      default = "traefik.nkagami.me";
+      description = "The host to be used for the dashboard";
+    };
+  };
+
+  config = mkIf cfg.enable {
+    # Enable it in the static config options.
+    services.traefik.staticConfigOptions.api.dashboard = true;
+
+    # Dynamic configuration
+    # ---------------------
+    ## Middleware
+    services.traefik.dynamicConfigOptions.http.middlewares.dashboard-auth.basicAuth.usersFile = cfg.usersFile;
+    ## Router
+    services.traefik.dynamicConfigOptions.http.routers.dashboard = {
+      rule = "Host(`${cfg.host}`)";
+      entryPoints = [ "https" ];
+      middlewares = [ "dashboard-auth" ];
+      service = "api@internal";
+    };
+  };
+}

modules/cloud/traefik/default.nix

@@ -21,7 +21,7 @@ let
   cfg = config.cloud.traefik;
 in
 {
-  imports = [ ./config.nix ];
+  imports = [ ./config.nix ./dashboard.nix ];
   options.cloud.traefik = {
     cloudflareKeyFile = mkOption {
       type = types.path;
@@ -58,10 +58,6 @@ in
       accessLog = {};
       log.level = "info";
 
-      # Dashboard
-      # ---------
-      api.dashboard = true;
-
       # ACME Automatic SSL
       # ------------------
       certificatesResolvers.le.acme = {

nki-personal-do/configuration.nix

@@ -47,6 +47,11 @@
   services.my-tinc.rsaPrivateKey = config.sops.secrets.tinc-private-key.path;
 
   # Set up traefik
-  sops.secrets.cloudflare-dns-api-token = {};
+  sops.secrets.cloudflare-dns-api-token = { owner = "traefik"; };
+  sops.secrets.traefik-dashboard-users = { owner = "traefik"; };
   cloud.traefik.cloudflareKeyFile = config.sops.secrets.cloudflare-dns-api-token.path;
+  cloud.traefik.dashboard = {
+    enable = true;
+    usersFile = config.sops.secrets.traefik-dashboard-users.path;
+  };
 }