dotfiles.nix/nixos/viridian/services/traefik/default.nix

157 lines
4.1 KiB
Nix

{ inputs, config, pkgs, ... }:
{
disabledModules = [ "services/web-servers/traefik.nix" ];
imports = [
"${inputs.nixpkgs-unstable}/nixos/modules/services/web-servers/traefik.nix"
./routers.nix
./middlewares.nix
./services.nix
];
age.secrets.traefik = {
# Environment variables for porkbun dns challenge
rekeyFile = ./environment.age;
owner = "traefik";
group = "traefik";
};
systemd.services.traefik.serviceConfig = {
User = "traefik";
Group = "traefik";
LogsDirectory = "traefik";
LogsDirectoryMode = "0750";
};
# Reverse proxy and load balancer for HTTP and TCP-based applications
services.traefik = {
enable = true;
package = pkgs.unstable.traefik;
dataDir = "/var/lib/traefik";
environmentFiles = [
config.age.secrets.traefik.path
];
# The startup configuration
staticConfigOptions = {
api = {
# Enable the API in secure mode
insecure = false;
# Enable the dashboard
dashboard = true;
};
log = {
filePath = "/var/log/traefik/traefik.log";
level = "ERROR";
};
accessLog = {
filePath = "/var/log/traefik/access.log";
format = "json";
};
# Install plugins
experimental.plugins = {
geoblock = {
moduleName = "github.com/PascalMinder/geoblock";
version = "v0.2.7";
};
};
# Network entry points into Traefik
entryPoints = {
# Hypertext Transfer Protocol
web = {
address = ":80";
# Redirect all incoming HTTP requests to HTTPS
http.redirections.entryPoint = {
to = "websecure";
scheme = "https";
};
};
# Hypertext Transfer Protocol Secure
websecure = {
address = ":443";
# Requests wildcard SSL certs for our services
http.tls = {
certResolver = "lets-encrypt";
# List of domains in our network
domains = [
# Internal services
{ main = "kanto.dev";
sans = [ "*.kanto.dev" ];
}
# Public services
{ main = "sajenim.dev";
sans = [ "*.sajenim.dev" ];
}
];
};
};
# Used to expose metrics
metrics = {
address = ":8082";
};
};
# Provide metrics for the prometheus backend
metrics = {
prometheus = {
entryPoint = "metrics";
buckets = [ "0.1" "0.3" "1.2" "5.0" ];
addEntryPointsLabels = true;
addRoutersLabels = true;
addServicesLabels = true;
};
};
# Retrieve certificates from an ACME server
certificatesResolvers = {
# Setup a lets-encrypt environment
lets-encrypt.acme = {
# Email address used for registration
email = "its.jassy@pm.me";
# File or key used for certificate storage
storage = "/var/lib/traefik/acme.json";
# Certificate authority server to use
caServer = "https://acme-v02.api.letsencrypt.org/directory";
# Use a DNS-01 ACME challenge
dnsChallenge = {
provider = "porkbun";
resolvers = [
"1.1.1.1:53"
"8.8.8.8:53"
];
};
};
};
# Disables SSL certificate verification between our traefik instance and our backend
serversTransport = {
insecureSkipVerify = true;
};
};
};
# Scrape our traefik metrics
services.prometheus.scrapeConfigs = [
{
job_name = "traefik";
static_configs = [{
targets = [ "127.0.0.1:8082" ];
}];
}
];
# Persist our traefik data & logs
environment.persistence."/persist" = {
directories = [
{ directory = "/var/lib/traefik"; user = "traefik"; group = "traefik"; }
{ directory = "/var/log/traefik"; user = "traefik"; group = "traefik"; }
{ directory = "/plugins-storage"; user = "traefik"; group = "traefik"; }
];
hideMounts = true;
};
}