nixos/services/traefik/default.nix

{...}: {
  imports = [../fail2ban/traefik.nix];
  services.traefik = {
    enable = true;
    staticConfigOptions = {
      api = {dashboard = true;};
      entryPoints = {
        http = {
          address = ":80";
          http.redirections.entryPoint = {
            to = "https";
            scheme = "https";
          };
        };
        https.address = ":443";
        traefik-internal.address = ":8080";
      };
      certificatesResolvers = {
        default = {
          acme = {
            email = "evie@xenia.me.uk";
            storage = "/var/lib/traefik/acme.json";
            httpChallenge = {entryPoint = "http";};
          };
        };
      };
    };
    dynamicConfigOptions = {
      tls.options.default.sniStrict = true;
      http = {
        routers = {
          api = {
            rule = "Host(`traefik.xenia.me.uk`)";
            entryPoints = ["http" "https"];
            service = "api@internal";
            middlewares = ["auth"];
            tls = {certResolver = "default";};
          };
          api-internal = {
            rule = "ClientIP(`192.168.0.0/16`)";
            entryPoints = ["traefik-internal"];
            service = "api@internal";
          };
        };
        middlewares = {
          auth.basicAuth.users = ["xenia:$apr1$LB0wVd6I$BHVPIyh.F5Ewt9/7PqAtS."];
          hsts.headers = {
            stsSeconds = "31536000";
            stsIncludeSubdomains = true;
          };
        };
      };
    };
  };
  networking.firewall = {
    enable = true;
    allowedTCPPorts = [80 443 8080];
  };
}