blob: 7d0e1fa50ea0e5c22a2ae0551870c7dffd3ec53a (
plain) (
blame)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
|
{ pkgs, config, lib, ... }:
let
mkServiceConfig = name: url: {
http.routers."${name}" = {
rule = "Host(`${domain}`) && PathPrefix(`/${name}`)";
service = "${name}";
tls.certResolver = "le";
};
http.services."${name}" = { loadBalancer.servers = [{ url = url; }]; };
};
in {
options.cloud.traefik = {
gcpKeyFile = mkOption {
type = types.path;
description = "The GCP private key file, for Let's Encrypt DNS challenge";
};
gcpProjectName = mkOption {
type = types.str;
description = "The GCP project name used for managing DNS";
};
certsPath = mkOption {
type = types.str;
default = "/var/lib/traefik/acme.json";
description = "The location to read and write the certificates file";
};
};
config.services.traefik = {
enable = true;
staticConfigOptions = {
entrypoints.http.address = ":80";
entrypoints.http.http.redirections.entryPoint = {
to = "https";
scheme = "https";
};
entrypoints.https.address = ":443";
accessLog.format = "json";
log.level = "warn";
global.checkNewVersion = false;
global.sendAnonymousUsage = false;
metrics.prometheus = {
addEntryPointsLabels = true;
addRoutersLabels = true;
addServicesLabels = true;
};
certificatesResolvers.le.acme = {
email = "franck@fcuny.net";
storage = cfg.certsPath;
dnsChallenge.provider = "gcloud";
dnsChallenge.delayBeforeCheck = 10;
};
};
};
services.traefik.dynamicConfigOptions =
mkMerge [ (mkServiceConfig "dash" "http://127.0.0.1:3000/") ];
# Set up cloudflare key
config.systemd.services.traefik.environment.GCE_SERVICE_ACCOUNT_FILE =
cfg.gcpKeyFile;
config.systemd.services.traefik.environment.GCE_PROJECT = cfg.gcpProjectName;
# Set up firewall to allow traefik traffic.
config.networking.firewall.allowedTCPPorts = [ 80 443 ];
config.networking.firewall.allowedUDPPorts = [ 443 ]; # QUIC
}
|
