traefik: initial configuration

I want to run traefik on the NAS, so I can reach grafana and other
future services running on that host.

To manage TLS, we use let's encrypt with a DNS challenge. For this to
work we need a service account configuration, that is encrypted with
age.

1 files changed, 12 insertions, 0 deletions

diff --git a/hosts/common/nas.nix b/hosts/common/nas.nix
index 92b0d3f..a45cab4 100644
--- a/hosts/common/nas.nix
+++ b/hosts/common/nas.nix
@@ -7,5 +7,17 @@
     ./server/prometheus.nix
     ./server/grafana.nix
     ./server/backups/users.nix
+    ./server/traefik.nix
   ];
+
+  age.secrets.traefik-gcp-sa = {
+    file = ../secrets/traefik/gcp_sa.age;
+    mode = "0440";
+    owner = "0";
+  };
+
+  traefik = {
+    gcpKeyFile = "/run/agenix/gcp_sa";
+    gcpProjectName = "fcuny-homelab";
+  };
 }