ghoscht/nix-config
ghoscht/nix-config
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Arion: Add wildcard certs to traefik

Browse source
This commit is contained in:
GHOSCHT 2024-06-29 20:27:08 +02:00
parent 099959a30a
commit 5a9cf4c15c
Signed by: ghoscht
GPG key ID: 2C2C1C62A5388E82
2 changed files with 49 additions and 43 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

22
hosts/franz/arion/infrastructure/arion-compose.nix
View file

@ -31,10 +31,16 @@
"traefik.http.services.dashboard.loadbalancer.server.port" = "8080"; "traefik.http.services.dashboard.loadbalancer.server.port" = "8080";
"traefik.http.routers.dashboard.tls" = "true"; "traefik.http.routers.dashboard.tls" = "true";
"traefik.http.routers.dashboard.tls.certresolver" = "letsencrypt"; "traefik.http.routers.dashboard.tls.certresolver" = "letsencrypt";
"traefik.http.routers.dashboard.tls.domains[0].main" = "ghoscht.com";
"traefik.http.routers.dashboard.tls.domains[0].sans" = "*.ghoscht.com";
"traefik.http.middlewares.traefik-https-redirect.redirectscheme.scheme" = "https";
"traefik.http.middlewares.sslheader.headers.customrequestheaders.X-Forwarded-Proto" = "https";
}; };
volumes = [ volumes = [
"traefik_letsencrypt:/letsencrypt" "/home/ghoscht/.docker/infrastructure/traefik_config/traefik.yml:/traefik.yml:ro"
"/home/ghoscht/.docker/infrastructure/traefik_data:/etc/traefik" "/storage/dataset/docker/infrastructure/traefik_data/acme.json:/acme.json"
"/var/run/docker.sock:/var/run/docker.sock:ro" "/var/run/docker.sock:/var/run/docker.sock:ro"
]; ];
env_file = [ env_file = [
@ -45,18 +51,6 @@
"dmz" "dmz"
]; ];
}; };
# cloudflared.service = {
# image = "cloudflare/cloudflared:2024.2.1";
# container_name = "cloudflared";
# env_file = [
# "/home/ghoscht/.docker/infrastructure/cloudflared.env"
# ];
# restart = "always";
# command = "tunnel --no-autoupdate --protocol http2 run";
# networks = [
# "dmz"
# ];
# };
scrutiny.service = { scrutiny.service = {
image = "ghcr.io/analogj/scrutiny:v0.8.0-omnibus"; image = "ghcr.io/analogj/scrutiny:v0.8.0-omnibus";
container_name = "scrutiny"; container_name = "scrutiny";

70
hosts/franz/arion/infrastructure/default.nix
View file

@ -57,38 +57,50 @@ in {
''; '';
}; };
sops.templates."traefik.toml" = { sops.templates."traefik.yml" = {
path = "/home/${vars.user}/.docker/infrastructure/traefik_data/traefik.toml"; path = "/home/${vars.user}/.docker/infrastructure/traefik_config/traefik.yml";
owner = vars.user; owner = vars.user;
mode = "0775"; mode = "0775";
content = '' content = ''
[entryPoints] api:
[entryPoints.web] dashboard: true
address = ":80" debug: true
[entryPoints.web-external] insecure: true
address = ":81" entryPoints:
[entryPoints.websecure] web:
address = ":443" address: ":80"
[entryPoints.websecure-external] http:
address = ":444" redirections:
[api] entrypoint:
dashboard = true to: websecure
insecure = true scheme: https
web-external:
[certificatesResolvers.letsencrypt.acme] address: ":81"
email = "${config.sops.placeholder."traefik/acme_email"}" http:
storage = "/letsencrypt/acme.json" redirections:
[certificatesResolvers.letsencrypt.acme.dnsChallenge] entrypoint:
provider = "cloudflare" to: websecure-external
resolvers = ["1.1.1.1:53", "1.0.0.1:53"] scheme: https
websecure:
[serversTransport] address: ":443"
insecureSkipVerify = true websecure-external:
address: ":444"
[providers.docker] providers:
watch = true providers:
network = "dmz" docker:
exposedByDefault = false # overriden by traefik.enable=true watch: true
exposedByDefault: false
network: dmz
certificatesResolvers:
letsencrypt:
acme:
email: ${config.sops.placeholder."traefik/acme_email"}
storage: acme.json
dnsChallenge:
provider: cloudflare
resolvers:
- "1.1.1.1:53"
- "1.0.0.1:53"
''; '';
}; };
sops.templates."diun.env" = { sops.templates."diun.env" = {