57 lines
1.4 KiB
Nix
57 lines
1.4 KiB
Nix
{...}: {
|
|
imports = [./fail2ban.nix];
|
|
services.traefik = {
|
|
enable = true;
|
|
staticConfigOptions = {
|
|
api = {insecure = true;};
|
|
entryPoints = {
|
|
http = {
|
|
address = ":80";
|
|
http.redirections.entryPoint = {
|
|
to = "https";
|
|
scheme = "https";
|
|
};
|
|
};
|
|
https = {address = ":443";};
|
|
ssh = {address = ":2222";};
|
|
};
|
|
certificatesResolvers = {
|
|
default = {
|
|
acme = {
|
|
email = "evie@xenia.me.uk";
|
|
storage = "/var/lib/traefik/acme.json";
|
|
httpChallenge = {entryPoint = "http";};
|
|
};
|
|
};
|
|
};
|
|
};
|
|
dynamicConfigOptions.http = {
|
|
routers.traefik = {
|
|
rule = "Host(`traefik.xenia.me.uk`)";
|
|
entryPoints = ["http" "https"];
|
|
service = "traefik-webinterface";
|
|
tls = {certResolver = "default";};
|
|
};
|
|
services.traefik-webinterface.loadBalancer.servers = [{url = "http://localhost:8080";}];
|
|
};
|
|
};
|
|
networking.firewall = {
|
|
enable = true;
|
|
allowedTCPPorts = [80 443 2222];
|
|
};
|
|
services.fail2ban.jails = {
|
|
traefik-http = ''
|
|
enabled = true
|
|
filter = traefik-auth
|
|
ports = http,https,2222
|
|
backend = systemd
|
|
'';
|
|
traefik-ssh = ''
|
|
enabled = true
|
|
filter = sshd
|
|
ports = 2222
|
|
backend = systemd
|
|
'';
|
|
};
|
|
}
|