traefik: initial configuration

I want to run traefik on the NAS, so I can reach grafana and other
future services running on that host.

To manage TLS, we use let's encrypt with a DNS challenge. For this to
work we need a service account configuration, that is encrypted with
age.

4 files changed, 90 insertions, 0 deletions

diff --git a/hosts/common/nas.nix b/hosts/common/nas.nix
index 92b0d3f..a45cab4 100644
--- a/hosts/common/nas.nix
+++ b/hosts/common/nas.nix
@@ -7,5 +7,17 @@
     ./server/prometheus.nix
     ./server/grafana.nix
     ./server/backups/users.nix
+    ./server/traefik.nix
   ];
+
+  age.secrets.traefik-gcp-sa = {
+    file = ../secrets/traefik/gcp_sa.age;
+    mode = "0440";
+    owner = "0";
+  };
+
+  traefik = {
+    gcpKeyFile = "/run/agenix/gcp_sa";
+    gcpProjectName = "fcuny-homelab";
+  };
 }
diff --git a/hosts/common/server/traefik.nix b/hosts/common/server/traefik.nix
new file mode 100644
index 0000000..7d0e1fa
--- /dev/null
+++ b/hosts/common/server/traefik.nix
@@ -0,0 +1,75 @@
+{ pkgs, config, lib, ... }:
+
+let
+  mkServiceConfig = name: url: {
+    http.routers."${name}" = {
+      rule = "Host(`${domain}`) && PathPrefix(`/${name}`)";
+      service = "${name}";
+      tls.certResolver = "le";
+    };
+    http.services."${name}" = { loadBalancer.servers = [{ url = url; }]; };
+  };
+in {
+  options.cloud.traefik = {
+    gcpKeyFile = mkOption {
+      type = types.path;
+      description = "The GCP private key file, for Let's Encrypt DNS challenge";
+    };
+
+    gcpProjectName = mkOption {
+      type = types.str;
+      description = "The GCP project name used for managing DNS";
+    };
+
+    certsPath = mkOption {
+      type = types.str;
+      default = "/var/lib/traefik/acme.json";
+      description = "The location to read and write the certificates file";
+    };
+  };
+
+  config.services.traefik = {
+    enable = true;
+
+    staticConfigOptions = {
+      entrypoints.http.address = ":80";
+      entrypoints.http.http.redirections.entryPoint = {
+        to = "https";
+        scheme = "https";
+      };
+      entrypoints.https.address = ":443";
+
+      accessLog.format = "json";
+      log.level = "warn";
+
+      global.checkNewVersion = false;
+      global.sendAnonymousUsage = false;
+
+      metrics.prometheus = {
+        addEntryPointsLabels = true;
+        addRoutersLabels = true;
+        addServicesLabels = true;
+      };
+
+      certificatesResolvers.le.acme = {
+        email = "franck@fcuny.net";
+        storage = cfg.certsPath;
+        dnsChallenge.provider = "gcloud";
+        dnsChallenge.delayBeforeCheck = 10;
+      };
+    };
+  };
+
+  services.traefik.dynamicConfigOptions =
+    mkMerge [ (mkServiceConfig "dash" "http://127.0.0.1:3000/") ];
+
+  # Set up cloudflare key
+  config.systemd.services.traefik.environment.GCE_SERVICE_ACCOUNT_FILE =
+    cfg.gcpKeyFile;
+
+  config.systemd.services.traefik.environment.GCE_PROJECT = cfg.gcpProjectName;
+
+  # Set up firewall to allow traefik traffic.
+  config.networking.firewall.allowedTCPPorts = [ 80 443 ];
+  config.networking.firewall.allowedUDPPorts = [ 443 ]; # QUIC
+}
diff --git a/secrets.nix b/secrets.nix
index 64c60c0..3d50744 100644
--- a/secrets.nix
+++ b/secrets.nix
@@ -15,4 +15,7 @@ in {
 
   "secrets/network/tahoe/wireguard_privatekey.age".publicKeys =
     [ fcuny_aptos aptos tahoe ];
+
+  "secrets/traefik/gcp_service_account.json.age".publicKeys =
+    [ fcuny_aptos aptos tahoe ];
 }
diff --git a/secrets/traefik/gcp_service_account.json.age b/secrets/traefik/gcp_service_account.json.age
new file mode 100644
index 0000000..0f99905
--- /dev/null
+++ b/secrets/traefik/gcp_service_account.json.age
Binary files differ