nix-configs

Personal NixOS and home-manager configuration files
Log | Files | Refs

traefik-ilias.nix (2303B)

      1 { config, lib, pkgs, vars, ... }:
      2 
      3 # OpenWRT setup for custom *.home. domain names:
      4 # uci add_list dhcp.@dnsmasq[0].rebind_domain='home.minskio.co.uk'
      5 # uci add_list dhcp.@dnsmasq[0].address='/home.minskio.co.uk/192.168.1.3'
      6 # uci commit dhcp
      7 # service dnsmasq restart
      8 
      9 let
     10   services = {
     11     drink  = { host = "127.0.0.1"; port = 9092; };
     12     pub    = { host = "127.0.0.1"; port = 9091; };
     13     stream = { host = "127.0.0.1"; port = 8080; };
     14     weight = { host = "127.0.0.1"; port = 9090; };
     15   };
     16 
     17   domain = "home.${vars.user.domain}";
     18 
     19   mkRouter = name: _: {
     20     name = name;
     21     value = {
     22       rule = "Host(`${name}.${domain}`)";
     23       entryPoints = [ "websecure" ];
     24       service = name;
     25       tls.certResolver = "cloudflare";
     26     };
     27   };
     28 
     29   mkService = name: svc: {
     30     name = name;
     31     value.loadBalancer.servers = [{ url = "http://${svc.host}:${toString svc.port}"; }];
     32   };
     33 in
     34 {
     35   services.traefik = {
     36     enable = true;
     37 
     38     staticConfigOptions = {
     39       # log.level = "DEBUG";
     40       entryPoints = {
     41         web.address = ":80";
     42         websecure.address = ":443";
     43       };
     44 
     45       certificatesResolvers.cloudflare.acme = {
     46         email = vars.user.email;
     47         storage = "/var/lib/traefik/acme.json";
     48         dnsChallenge = {
     49           provider = "cloudflare";
     50           # Query public DNS, since your dnsmasq override hides the real TXT records
     51           resolvers = [ "1.1.1.1:53" "8.8.8.8:53" ];
     52         };
     53       };
     54     };
     55 
     56     dynamicConfigOptions.http = {
     57       routers = (lib.mapAttrs' mkRouter services) // {
     58         # http -> https for the named hosts
     59         redirect = {
     60           rule = "HostRegexp(`^.+\\.home\\.${lib.replaceStrings [ "." ] [ "\\." ] vars.user.domain}$`)";
     61           entryPoints = [ "web" ];
     62           middlewares = [ "https-redirect" ];
     63           service = "noop@internal";
     64         };
     65         # http://192.168.1.3 fallback to Stromboli
     66         fallback = {
     67           rule = "Host(`192.168.1.3`)";
     68           entryPoints = [ "web" ];
     69           service = "stream";
     70         };
     71       };
     72 
     73       middlewares.https-redirect.redirectScheme.scheme = "https";
     74       services = lib.mapAttrs' mkService services;
     75     };
     76   };
     77 
     78   systemd.services.traefik.environment = { CF_DNS_API_TOKEN = vars.secrets.cloudflare; };
     79 
     80   networking.firewall.allowedTCPPorts = [ 80 443 ];
     81 }