diff options
| -rw-r--r-- | hosts/common/nas.nix | 12 | ||||
| -rw-r--r-- | hosts/common/server/traefik.nix | 75 | ||||
| -rw-r--r-- | secrets.nix | 3 | ||||
| -rw-r--r-- | secrets/traefik/gcp_service_account.json.age | bin | 0 -> 2827 bytes |
4 files changed, 90 insertions, 0 deletions
diff --git a/hosts/common/nas.nix b/hosts/common/nas.nix index 92b0d3f..a45cab4 100644 --- a/hosts/common/nas.nix +++ b/hosts/common/nas.nix @@ -7,5 +7,17 @@ ./server/prometheus.nix ./server/grafana.nix ./server/backups/users.nix + ./server/traefik.nix ]; + + age.secrets.traefik-gcp-sa = { + file = ../secrets/traefik/gcp_sa.age; + mode = "0440"; + owner = "0"; + }; + + traefik = { + gcpKeyFile = "/run/agenix/gcp_sa"; + gcpProjectName = "fcuny-homelab"; + }; } diff --git a/hosts/common/server/traefik.nix b/hosts/common/server/traefik.nix new file mode 100644 index 0000000..7d0e1fa --- /dev/null +++ b/hosts/common/server/traefik.nix @@ -0,0 +1,75 @@ +{ pkgs, config, lib, ... }: + +let + mkServiceConfig = name: url: { + http.routers."${name}" = { + rule = "Host(`${domain}`) && PathPrefix(`/${name}`)"; + service = "${name}"; + tls.certResolver = "le"; + }; + http.services."${name}" = { loadBalancer.servers = [{ url = url; }]; }; + }; +in { + options.cloud.traefik = { + gcpKeyFile = mkOption { + type = types.path; + description = "The GCP private key file, for Let's Encrypt DNS challenge"; + }; + + gcpProjectName = mkOption { + type = types.str; + description = "The GCP project name used for managing DNS"; + }; + + certsPath = mkOption { + type = types.str; + default = "/var/lib/traefik/acme.json"; + description = "The location to read and write the certificates file"; + }; + }; + + config.services.traefik = { + enable = true; + + staticConfigOptions = { + entrypoints.http.address = ":80"; + entrypoints.http.http.redirections.entryPoint = { + to = "https"; + scheme = "https"; + }; + entrypoints.https.address = ":443"; + + accessLog.format = "json"; + log.level = "warn"; + + global.checkNewVersion = false; + global.sendAnonymousUsage = false; + + metrics.prometheus = { + addEntryPointsLabels = true; + addRoutersLabels = true; + addServicesLabels = true; + }; + + certificatesResolvers.le.acme = { + email = "franck@fcuny.net"; + storage = cfg.certsPath; + dnsChallenge.provider = "gcloud"; + dnsChallenge.delayBeforeCheck = 10; + }; + }; + }; + + services.traefik.dynamicConfigOptions = + mkMerge [ (mkServiceConfig "dash" "http://127.0.0.1:3000/") ]; + + # Set up cloudflare key + config.systemd.services.traefik.environment.GCE_SERVICE_ACCOUNT_FILE = + cfg.gcpKeyFile; + + config.systemd.services.traefik.environment.GCE_PROJECT = cfg.gcpProjectName; + + # Set up firewall to allow traefik traffic. + config.networking.firewall.allowedTCPPorts = [ 80 443 ]; + config.networking.firewall.allowedUDPPorts = [ 443 ]; # QUIC +} diff --git a/secrets.nix b/secrets.nix index 64c60c0..3d50744 100644 --- a/secrets.nix +++ b/secrets.nix @@ -15,4 +15,7 @@ in { "secrets/network/tahoe/wireguard_privatekey.age".publicKeys = [ fcuny_aptos aptos tahoe ]; + + "secrets/traefik/gcp_service_account.json.age".publicKeys = + [ fcuny_aptos aptos tahoe ]; } diff --git a/secrets/traefik/gcp_service_account.json.age b/secrets/traefik/gcp_service_account.json.age new file mode 100644 index 0000000..0f99905 --- /dev/null +++ b/secrets/traefik/gcp_service_account.json.age Binary files differ |