nix-configs

commit 69ce99bd381c6427f18226e75af4bbb48b4405c6
parent 2ff36b9e6b80183427d6533afb2e5f243bf5107d
Author: Peter <peter@minskio.co.uk>
Date:   Fri, 23 Oct 2026 14:00:01 +0100

Replace caddy with traefik for ilias

Cloudflare plugin rebuilds are getting me down whereas traefik natively supports it.
I'll probably use Traefik once I've replaced my docker stack on artemis too to keep things consistent

Diffstat:
D
common/caddy-ilias.nix
 | 
43
-------------------------------------------
A
common/traefik-ilias.nix
 | 
81
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
M
machines/ilias.nix
 | 
2
+-

3 files changed, 82 insertions(+), 44 deletions(-)
diff --git a/common/caddy-ilias.nix b/common/caddy-ilias.nix
@@ -1,43 +0,0 @@
-{ config, lib, pkgs, vars, ... }:
-
-# OpenWRT setup for custom *.home. domain names:
-# uci add_list dhcp.@dnsmasq[0].rebind_domain='home.minskio.co.uk'
-# uci add_list dhcp.@dnsmasq[0].address='/home.minskio.co.uk/192.168.1.3'
-# uci commit dhcp
-# service dnsmasq restart
-
-let
-  services = {
-    drink =  { host = "127.0.0.1"; port = 9092; };
-    pub    = { host = "127.0.0.1"; port = 9091; };
-    stream = { host = "127.0.0.1"; port = 8080; };
-    weight = { host = "127.0.0.1"; port = 9090; };
-  };
-
-  mkVirtualHost = name: svc: {
-    name = "${name}.home.${vars.user.domain}";
-    value = {
-      extraConfig = ''
-        tls {
-          dns cloudflare ${vars.secrets.cloudflare}
-        }
-        reverse_proxy ${svc.host}:${toString svc.port}
-      '';
-    };
-  };
-in
-{
-  services.caddy = {
-    enable = true;
-    package = pkgs.caddy.withPlugins {
-      plugins = [ "github.com/caddy-dns/cloudflare@v0.2.4" ];
-      hash = "sha256-xRJ5evsAJ2akg47j3Bt6YDXJOgX88B/rKNP50KSVyNY=";
-    };
-    virtualHosts = (lib.mapAttrs' mkVirtualHost services) // {
-      # Handle http://192.168.1.3:80/ fallback to Stromboli
-      "http://192.168.1.3" = { extraConfig = "reverse_proxy 127.0.0.1:8080"; };
-    };
-  };
-
-  networking.firewall.allowedTCPPorts = [ 80 443 ];
-}
diff --git a/common/traefik-ilias.nix b/common/traefik-ilias.nix
@@ -0,0 +1,81 @@
+{ config, lib, pkgs, vars, ... }:
+
+# OpenWRT setup for custom *.home. domain names:
+# uci add_list dhcp.@dnsmasq[0].rebind_domain='home.minskio.co.uk'
+# uci add_list dhcp.@dnsmasq[0].address='/home.minskio.co.uk/192.168.1.3'
+# uci commit dhcp
+# service dnsmasq restart
+
+let
+  services = {
+    drink  = { host = "127.0.0.1"; port = 9092; };
+    pub    = { host = "127.0.0.1"; port = 9091; };
+    stream = { host = "127.0.0.1"; port = 8080; };
+    weight = { host = "127.0.0.1"; port = 9090; };
+  };
+
+  domain = "home.${vars.user.domain}";
+
+  mkRouter = name: _: {
+    name = name;
+    value = {
+      rule = "Host(`${name}.${domain}`)";
+      entryPoints = [ "websecure" ];
+      service = name;
+      tls.certResolver = "cloudflare";
+    };
+  };
+
+  mkService = name: svc: {
+    name = name;
+    value.loadBalancer.servers = [{ url = "http://${svc.host}:${toString svc.port}"; }];
+  };
+in
+{
+  services.traefik = {
+    enable = true;
+
+    staticConfigOptions = {
+      # log.level = "DEBUG";
+      entryPoints = {
+        web.address = ":80";
+        websecure.address = ":443";
+      };
+
+      certificatesResolvers.cloudflare.acme = {
+        email = vars.user.email;
+        storage = "/var/lib/traefik/acme.json";
+        dnsChallenge = {
+          provider = "cloudflare";
+          # Query public DNS, since your dnsmasq override hides the real TXT records
+          resolvers = [ "1.1.1.1:53" "8.8.8.8:53" ];
+        };
+      };
+    };
+
+    dynamicConfigOptions.http = {
+      routers = (lib.mapAttrs' mkRouter services) // {
+        # http -> https for the named hosts
+        redirect = {
+          rule = "HostRegexp(`^.+\\.home\\.${lib.replaceStrings [ "." ] [ "\\." ] vars.user.domain}$`)";
+          entryPoints = [ "web" ];
+          middlewares = [ "https-redirect" ];
+          service = "noop@internal";
+        };
+        # http://192.168.1.3 fallback to Stromboli
+        fallback = {
+          rule = "Host(`192.168.1.3`)";
+          entryPoints = [ "web" ];
+          service = "stream";
+        };
+      };
+
+      middlewares.https-redirect.redirectScheme.scheme = "https";
+      services = lib.mapAttrs' mkService services;
+    };
+  };
+
+  systemd.services.traefik.environment = { CF_DNS_API_TOKEN = vars.secrets.cloudflare; };
+
+  networking.firewall.allowedTCPPorts = [ 80 443 ];
+}
diff --git a/machines/ilias.nix b/machines/ilias.nix
@@ -9,7 +9,6 @@
     # ../common/cec-mini-kb.nix
     ../common/boot-systemd.nix
     ../common/bruschetta.nix
-    ../common/caddy-ilias.nix
     ../common/devel.nix
     ../common/flakes.nix
     ../common/garbage.nix
@@ -27,6 +26,7 @@
     ../common/stromboli.nix
     ../common/syncthing.nix
     ../common/tagliatelle.nix
+    ../common/traefik-ilias.nix
     ../common/user.nix
     ../common/zerotier.nix
     ../scripts/audiobook-cleaner.nix