Evie Litherland-Smith
a1c28e779a
Remove jupyter service and qbittorrent traefik route Add ntfy-sh (enabled) and initial grafana (not enabled) expressions Change services to call own traefik expression, rather than needing to be called explicitly
63 lines
1.6 KiB
Nix
63 lines
1.6 KiB
Nix
{ config, lib, pkgs, ... }:
|
|
|
|
{
|
|
imports = [ ../fail2ban/traefik.nix ];
|
|
services.traefik = {
|
|
enable = true;
|
|
staticConfigOptions = {
|
|
api = { dashboard = true; };
|
|
entryPoints = {
|
|
http = {
|
|
address = ":80";
|
|
http.redirections.entryPoint = {
|
|
to = "https";
|
|
scheme = "https";
|
|
};
|
|
};
|
|
https.address = ":443";
|
|
traefik-internal.address = ":8080";
|
|
};
|
|
certificatesResolvers = {
|
|
default = {
|
|
acme = {
|
|
email = "evie@xenia.me.uk";
|
|
storage = "/var/lib/traefik/acme.json";
|
|
httpChallenge = { entryPoint = "http"; };
|
|
};
|
|
};
|
|
};
|
|
};
|
|
dynamicConfigOptions = {
|
|
tls.options.default.sniStrict = true;
|
|
http = {
|
|
routers = {
|
|
api = {
|
|
rule = "Host(`traefik.xenia.me.uk`)";
|
|
entryPoints = [ "http" "https" ];
|
|
service = "api@internal";
|
|
middlewares = [ "auth" ];
|
|
tls = { certResolver = "default"; };
|
|
};
|
|
api-internal = {
|
|
rule = "ClientIP(`192.168.0.0/16`)";
|
|
entryPoints = [ "traefik-internal" ];
|
|
service = "api@internal";
|
|
};
|
|
};
|
|
middlewares = {
|
|
auth.basicAuth.users =
|
|
[ "xenia:$apr1$LB0wVd6I$BHVPIyh.F5Ewt9/7PqAtS." ];
|
|
hsts.headers = {
|
|
stsSeconds = "31536000";
|
|
stsIncludeSubdomains = true;
|
|
};
|
|
};
|
|
};
|
|
};
|
|
};
|
|
networking.firewall = {
|
|
enable = true;
|
|
allowedTCPPorts = [ 80 443 8080 ];
|
|
};
|
|
}
|