{ pkgs, inputs, config, lib, ... }: with lib; let domain = "fcuny.xyz"; mkServiceConfig = name: url: { http.routers."${name}" = { rule = "Host(`${name}.${domain}`)"; service = "${name}"; tls.certResolver = "le"; }; http.services."${name}" = { loadBalancer.servers = [{ url = url; }]; }; }; in { age.secrets.traefik_gcp_sa = { file = ../../../secrets/traefik/gcp_service_account.json.age; owner = "traefik"; }; services.traefik = { enable = true; staticConfigOptions = { metrics.prometheus = { addEntryPointsLabels = true; addRoutersLabels = true; addServicesLabels = true; }; global = { checkNewVersion = false; sendAnonymousUsage = false; }; accessLog.format = "json"; log.level = "warn"; entryPoints.http.http.redirections = { entryPoint.to = "https"; entryPoint.scheme = "https"; entryPoint.permanent = true; }; entryPoints.http.address = ":80"; entryPoints.https.address = ":443"; # the default is 8080, which conflict with unifi entryPoints.traefik.address = ":8090"; api = { dashboard = true; insecure = true; }; # The unifi controller runs on HTTPS with a self-signed # certificate, as a result we need to accept insecure # certificates. serversTransport.insecureSkipVerify = true; certificatesResolvers = { le.acme = { email = "franck@fcuny.net"; storage = "/var/lib/traefik/cert.json"; dnsChallenge = { provider = "gcloud"; delayBeforeCheck = 0; }; }; }; }; }; services.traefik.dynamicConfigOptions = mkMerge [ (mkServiceConfig "dash" "http://127.0.0.1:3000/") (mkServiceConfig "bt" "http://127.0.0.1:9091/") (mkServiceConfig "unifi" "https://127.0.0.1:8443/") ]; systemd.services.traefik.environment.GCE_SERVICE_ACCOUNT_FILE = config.age.secrets.traefik_gcp_sa.path; systemd.services.traefik.environment.GCE_PROJECT = "fcuny-homelab"; networking.firewall.allowedTCPPorts = [ 80 443 ]; networking.firewall.allowedUDPPorts = [ 443 ]; # QUIC }