ghoscht/nix-config
ghoscht/nix-config
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Arion: Add wildcard certs to traefik

Browse source
This commit is contained in:
GHOSCHT 2024-06-29 20:27:08 +02:00
parent 099959a30a
commit 5a9cf4c15c
Signed by: ghoscht
GPG key ID: 2C2C1C62A5388E82
2 changed files with 49 additions and 43 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

22
hosts/franz/arion/infrastructure/arion-compose.nix
View file

@ -31,10 +31,16 @@
"traefik.http.services.dashboard.loadbalancer.server.port" = "8080";
"traefik.http.routers.dashboard.tls" = "true";
"traefik.http.routers.dashboard.tls.certresolver" = "letsencrypt";
"traefik.http.routers.dashboard.tls.domains[0].main" = "ghoscht.com";
"traefik.http.routers.dashboard.tls.domains[0].sans" = "*.ghoscht.com";
"traefik.http.middlewares.traefik-https-redirect.redirectscheme.scheme" = "https";
"traefik.http.middlewares.sslheader.headers.customrequestheaders.X-Forwarded-Proto" = "https";
};
volumes = [
"traefik_letsencrypt:/letsencrypt"
"/home/ghoscht/.docker/infrastructure/traefik_data:/etc/traefik"
"/home/ghoscht/.docker/infrastructure/traefik_config/traefik.yml:/traefik.yml:ro"
"/storage/dataset/docker/infrastructure/traefik_data/acme.json:/acme.json"
"/var/run/docker.sock:/var/run/docker.sock:ro"
];
env_file = [
@ -45,18 +51,6 @@
"dmz"
];
};
# cloudflared.service = {
# image = "cloudflare/cloudflared:2024.2.1";
# container_name = "cloudflared";
# env_file = [
# "/home/ghoscht/.docker/infrastructure/cloudflared.env"
# ];
# restart = "always";
# command = "tunnel --no-autoupdate --protocol http2 run";
# networks = [
# "dmz"
# ];
# };
scrutiny.service = {
image = "ghcr.io/analogj/scrutiny:v0.8.0-omnibus";
container_name = "scrutiny";

70
hosts/franz/arion/infrastructure/default.nix
View file

@ -57,38 +57,50 @@ in {
'';
};
sops.templates."traefik.toml" = {
path = "/home/${vars.user}/.docker/infrastructure/traefik_data/traefik.toml";
sops.templates."traefik.yml" = {
path = "/home/${vars.user}/.docker/infrastructure/traefik_config/traefik.yml";
owner = vars.user;
mode = "0775";
content = ''
[entryPoints]
[entryPoints.web]
address = ":80"
[entryPoints.web-external]
address = ":81"
[entryPoints.websecure]
address = ":443"
[entryPoints.websecure-external]
address = ":444"
[api]
dashboard = true
insecure = true
[certificatesResolvers.letsencrypt.acme]
email = "${config.sops.placeholder."traefik/acme_email"}"
storage = "/letsencrypt/acme.json"
[certificatesResolvers.letsencrypt.acme.dnsChallenge]
provider = "cloudflare"
resolvers = ["1.1.1.1:53", "1.0.0.1:53"]
[serversTransport]
insecureSkipVerify = true
[providers.docker]
watch = true
network = "dmz"
exposedByDefault = false # overriden by traefik.enable=true
api:
dashboard: true
debug: true
insecure: true
entryPoints:
web:
address: ":80"
http:
redirections:
entrypoint:
to: websecure
scheme: https
web-external:
address: ":81"
http:
redirections:
entrypoint:
to: websecure-external
scheme: https
websecure:
address: ":443"
websecure-external:
address: ":444"
providers:
providers:
docker:
watch: true
exposedByDefault: false
network: dmz
certificatesResolvers:
letsencrypt:
acme:
email: ${config.sops.placeholder."traefik/acme_email"}
storage: acme.json
dnsChallenge:
provider: cloudflare
resolvers:
- "1.1.1.1:53"
- "1.0.0.1:53"
'';
};
sops.templates."diun.env" = {