Add peertube

modules/cloud/traefik/default.nix

@@ -20,6 +20,24 @@ let
     in
     valueType;
 
+  # https://www.cloudflare.com/ips/
+  trustedIPs =
+    let
+      files = [
+        (pkgs.fetchurl {
+          url = "https://www.cloudflare.com/ips-v4";
+          hash = "sha256-8Cxtg7wBqwroV3Fg4DbXAMdFU1m84FTfiE5dfZ5Onns=";
+        })
+        (pkgs.fetchurl {
+          url = "https://www.cloudflare.com/ips-v6";
+          hash = "sha256-np054+g7rQDE3sr9U8Y/piAp89ldto3pN9K+KCNMoKk=";
+        })
+      ];
+
+      readLines = path: lib.splitString "\n" (builtins.readFile path);
+    in
+    lib.concatMap readLines files;
+
   cfg = config.cloud.traefik;
 in
 {
@@ -57,6 +75,7 @@ in
       };
       ## HTTPS entrypoint: ok!
       entrypoints.https.address = ":443";
+      entrypoints.https.forwardedHeaders.trustedIPs = trustedIPs;
       ## IMAP and SMTP
       entrypoints.imap.address = ":993";
       entrypoints.smtp-submission.address = ":587";