Use labels for reverse proxy podman services

modules/podman.nix

@@ -40,6 +40,16 @@ in
           "/home/yanlin/.config/nix/config/homeassistant/scripts.yaml:/config/scripts.yaml:ro"
         ];
 
+        labels = {
+          "traefik.enable" = "true";
+          "traefik.http.routers.homeassistant.rule" = "Host(`home.${config.networking.hostName}.yanlincs.com`)";
+          "traefik.http.routers.homeassistant.entrypoints" = "websecure";
+          "traefik.http.routers.homeassistant.tls" = "true";
+          "traefik.http.routers.homeassistant.tls.certresolver" = "cloudflare";
+          "traefik.http.routers.homeassistant.tls.domains[0].main" = "*.${config.networking.hostName}.yanlincs.com";
+          "traefik.http.services.homeassistant.loadbalancer.server.port" = "8123";
+        };
+        
         environment = {
           TZ = "Europe/Copenhagen";
           # Configure Home Assistant to trust reverse proxy
@@ -70,6 +80,16 @@ in
           "${immichConfigFile}:/config/immich.json:ro"
         ];
 
+        labels = {
+          "traefik.enable" = "true";
+          "traefik.http.routers.immich.rule" = "Host(`photo.${config.networking.hostName}.yanlincs.com`)";
+          "traefik.http.routers.immich.entrypoints" = "websecure";
+          "traefik.http.routers.immich.tls" = "true";
+          "traefik.http.routers.immich.tls.certresolver" = "cloudflare";
+          "traefik.http.routers.immich.tls.domains[0].main" = "*.${config.networking.hostName}.yanlincs.com";
+          "traefik.http.services.immich.loadbalancer.server.port" = "8080";
+        };
+        
         environment = {
           PUID = "1000";
           PGID = "100";
@@ -147,6 +167,16 @@ in
           "/mnt/storage/Media:/data"
         ];
 
+        labels = {
+          "traefik.enable" = "true";
+          "traefik.http.routers.plex.rule" = "Host(`plex.${config.networking.hostName}.yanlincs.com`)";
+          "traefik.http.routers.plex.entrypoints" = "websecure";
+          "traefik.http.routers.plex.tls" = "true";
+          "traefik.http.routers.plex.tls.certresolver" = "cloudflare";
+          "traefik.http.routers.plex.tls.domains[0].main" = "*.${config.networking.hostName}.yanlincs.com";
+          "traefik.http.services.plex.loadbalancer.server.port" = "32400";
+        };
+        
         environment = {
           PUID = "1000";
           PGID = "100";
@@ -154,10 +184,6 @@ in
           VERSION = "docker";
         };
         
-        ports = [
-          "32400:32400"
-        ];
-        
         extraOptions = [
           "--network=podman"
           "--device=/dev/dri:/dev/dri"  # Hardware acceleration
@@ -175,16 +201,22 @@ in
           "/mnt/storage/Media:/data"
         ];
 
+        labels = {
+          "traefik.enable" = "true";
+          "traefik.http.routers.sonarr.rule" = "Host(`sonarr.${config.networking.hostName}.yanlincs.com`)";
+          "traefik.http.routers.sonarr.entrypoints" = "websecure";
+          "traefik.http.routers.sonarr.tls" = "true";
+          "traefik.http.routers.sonarr.tls.certresolver" = "cloudflare";
+          "traefik.http.routers.sonarr.tls.domains[0].main" = "*.${config.networking.hostName}.yanlincs.com";
+          "traefik.http.services.sonarr.loadbalancer.server.port" = "8989";
+        };
+        
         environment = {
           PUID = "1000";
           PGID = "100";
           TZ = "Europe/Copenhagen";
         };
         
-        ports = [
-          "8989:8989"
-        ];
-        
         extraOptions = [
           "--network=podman"
         ];
@@ -201,16 +233,22 @@ in
           "/mnt/storage/Media:/data"
         ];
 
+        labels = {
+          "traefik.enable" = "true";
+          "traefik.http.routers.radarr.rule" = "Host(`radarr.${config.networking.hostName}.yanlincs.com`)";
+          "traefik.http.routers.radarr.entrypoints" = "websecure";
+          "traefik.http.routers.radarr.tls" = "true";
+          "traefik.http.routers.radarr.tls.certresolver" = "cloudflare";
+          "traefik.http.routers.radarr.tls.domains[0].main" = "*.${config.networking.hostName}.yanlincs.com";
+          "traefik.http.services.radarr.loadbalancer.server.port" = "7878";
+        };
+        
         environment = {
           PUID = "1000";
           PGID = "100";
           TZ = "Europe/Copenhagen";
         };
         
-        ports = [
-          "7878:7878"
-        ];
-        
         extraOptions = [
           "--network=podman"
         ];
@@ -227,16 +265,22 @@ in
           "/mnt/storage/Media:/data"
         ];
 
+        labels = {
+          "traefik.enable" = "true";
+          "traefik.http.routers.bazarr.rule" = "Host(`bazarr.${config.networking.hostName}.yanlincs.com`)";
+          "traefik.http.routers.bazarr.entrypoints" = "websecure";
+          "traefik.http.routers.bazarr.tls" = "true";
+          "traefik.http.routers.bazarr.tls.certresolver" = "cloudflare";
+          "traefik.http.routers.bazarr.tls.domains[0].main" = "*.${config.networking.hostName}.yanlincs.com";
+          "traefik.http.services.bazarr.loadbalancer.server.port" = "6767";
+        };
+        
         environment = {
           PUID = "1000";
           PGID = "100";
           TZ = "Europe/Copenhagen";
         };
         
-        ports = [
-          "6767:6767"
-        ];
-        
         extraOptions = [
           "--network=podman"
         ];
@@ -253,6 +297,16 @@ in
           "/mnt/storage/Media:/data"
         ];
 
+        labels = {
+          "traefik.enable" = "true";
+          "traefik.http.routers.qbittorrent.rule" = "Host(`qbit.${config.networking.hostName}.yanlincs.com`)";
+          "traefik.http.routers.qbittorrent.entrypoints" = "websecure";
+          "traefik.http.routers.qbittorrent.tls" = "true";
+          "traefik.http.routers.qbittorrent.tls.certresolver" = "cloudflare";
+          "traefik.http.routers.qbittorrent.tls.domains[0].main" = "*.${config.networking.hostName}.yanlincs.com";
+          "traefik.http.services.qbittorrent.loadbalancer.server.port" = "8080";
+        };
+        
         environment = {
           PUID = "1000";
           PGID = "100";
@@ -279,26 +333,32 @@ in
           "/mnt/storage/appbulk/Paperless/export:/usr/src/paperless/export"
         ];
 
+        labels = {
+          "traefik.enable" = "true";
+          "traefik.http.routers.paperless.rule" = "Host(`paperless.${config.networking.hostName}.yanlincs.com`)";
+          "traefik.http.routers.paperless.entrypoints" = "websecure";
+          "traefik.http.routers.paperless.tls" = "true";
+          "traefik.http.routers.paperless.tls.certresolver" = "cloudflare";
+          "traefik.http.routers.paperless.tls.domains[0].main" = "*.${config.networking.hostName}.yanlincs.com";
+          "traefik.http.services.paperless.loadbalancer.server.port" = "8000";
+        };
+        
         environment = {
           PAPERLESS_REDIS = "redis://paperless-redis:6379";
           PAPERLESS_OCR_LANGUAGE = "eng+chi_sim";
           PAPERLESS_OCR_LANGUAGES = "chi-sim";
           PAPERLESS_FILENAME_FORMAT = "{{ created }}-{{ correspondent }}-{{ title }}";
           PAPERLESS_TIME_ZONE = "Europe/Copenhagen";
-          PAPERLESS_URL = "https://paperless.hs.yanlincs.com";
+          PAPERLESS_URL = "https://paperless.${config.networking.hostName}.yanlincs.com";
-          PAPERLESS_CSRF_TRUSTED_ORIGINS = "https://paperless.hs.yanlincs.com";
+          PAPERLESS_CSRF_TRUSTED_ORIGINS = "https://paperless.${config.networking.hostName}.yanlincs.com";
-          PAPERLESS_ALLOWED_HOSTS = "paperless.hs.yanlincs.com";
+          PAPERLESS_ALLOWED_HOSTS = "paperless.${config.networking.hostName}.yanlincs.com";
-          PAPERLESS_CORS_ALLOWED_HOSTS = "https://paperless.hs.yanlincs.com";
+          PAPERLESS_CORS_ALLOWED_HOSTS = "https://paperless.${config.networking.hostName}.yanlincs.com";
           PAPERLESS_SECRET_KEY = "e11fl1oa-*ytql8p)(06fbj4ukrlo+n7k&q5+$1md7i+mge=ee";
           USERMAP_UID = "1000";
           USERMAP_GID = "100";
           CA_TS_FALLBACK_DIR = "/usr/src/paperless/data";
         };
         
-        ports = [
-          "8001:8000"
-        ];
-        
         extraOptions = [
           "--network=podman"
         ];
@@ -322,11 +382,21 @@ in
       containers.rss = {
         image = "docker.io/miniflux/miniflux:latest";
 
+        labels = {
+          "traefik.enable" = "true";
+          "traefik.http.routers.rss.rule" = "Host(`rss.${config.networking.hostName}.yanlincs.com`)";
+          "traefik.http.routers.rss.entrypoints" = "websecure";
+          "traefik.http.routers.rss.tls" = "true";
+          "traefik.http.routers.rss.tls.certresolver" = "cloudflare";
+          "traefik.http.routers.rss.tls.domains[0].main" = "*.${config.networking.hostName}.yanlincs.com";
+          "traefik.http.services.rss.loadbalancer.server.port" = "8080";
+        };
+        
         environment = {
           DATABASE_URL = "postgres://miniflux:miniflux@rss-db/miniflux?sslmode=disable";
           ADMIN_USERNAME = "yanlin";
           ADMIN_PASSWORD = "1Hayashi-2Hiko";
-          BASE_URL = "https://rss.hs.yanlincs.com";
+          BASE_URL = "https://rss.${config.networking.hostName}.yanlincs.com";
           CREATE_ADMIN = "1";
           RUN_MIGRATIONS = "1";
           HTTP_CLIENT_TIMEOUT = "50000";
@@ -336,10 +406,6 @@ in
           CLEANUP_REMOVE_SESSIONS_DAYS = "30";
         };
         
-        ports = [
-          "8002:8080"
-        ];
-        
         extraOptions = [
           "--network=podman"
         ];
@@ -377,9 +443,15 @@ in
           "/var/lib/containers/link:/etc/linkding/data"
         ];
 
-        ports = [
+        labels = {
-          "9090:9090"
+          "traefik.enable" = "true";
-        ];
+          "traefik.http.routers.linkding.rule" = "Host(`link.${config.networking.hostName}.yanlincs.com`)";
+          "traefik.http.routers.linkding.entrypoints" = "websecure";
+          "traefik.http.routers.linkding.tls" = "true";
+          "traefik.http.routers.linkding.tls.certresolver" = "cloudflare";
+          "traefik.http.routers.linkding.tls.domains[0].main" = "*.${config.networking.hostName}.yanlincs.com";
+          "traefik.http.services.linkding.loadbalancer.server.port" = "9090";
+        };
         
         extraOptions = [
           "--network=podman"
@@ -397,6 +469,16 @@ in
           "/mnt/storage/appbulk/cloud:/data"
         ];
 
+        labels = {
+          "traefik.enable" = "true";
+          "traefik.http.routers.cloud.rule" = "Host(`cloud.${config.networking.hostName}.yanlincs.com`)";
+          "traefik.http.routers.cloud.entrypoints" = "websecure";
+          "traefik.http.routers.cloud.tls" = "true";
+          "traefik.http.routers.cloud.tls.certresolver" = "cloudflare";
+          "traefik.http.routers.cloud.tls.domains[0].main" = "*.${config.networking.hostName}.yanlincs.com";
+          "traefik.http.services.cloud.loadbalancer.server.port" = "80";
+        };
+        
         environment = {
           PUID = "1000";
           PGID = "100";

modules/syncthing.nix

@@ -96,4 +96,8 @@
   launchd.agents.syncthing = lib.mkIf (pkgs.stdenv.isDarwin && config.services.syncthing.enable) {
     config.RunAtLoad = true;
   };
+
+  # For NixOS systems, we need to add Syncthing as a manual service in Traefik
+  # Since Syncthing runs as a systemd service (not container), we'll handle routing via static config
+  # or create a container wrapper for it to use with service discovery
 }

modules/traefik.nix

@@ -7,6 +7,12 @@
     
     # Static configuration
     staticConfigOptions = {
+      # Enable Docker provider for automatic service discovery
+      providers.docker = {
+        endpoint = "unix:///var/run/docker.sock";
+        exposedByDefault = false;  # Only expose containers with traefik.enable=true
+        network = "podman";  # Use podman network
+      };
       # Entry points for HTTP and HTTPS
       entrypoints = {
         web = {
@@ -57,146 +63,22 @@
       };
     };
 
-    # Dynamic configuration for services
+    # Dynamic configuration for services not running in containers
     dynamicConfigOptions = {
       http = {
         routers = {
-          homeassistant = {
-            rule = "Host(`home.hs.yanlincs.com`)";
-            service = "homeassistant";
-            tls = {
-              certResolver = "cloudflare";
-              domains = [{
-                main = "*.hs.yanlincs.com";
-              }];
-            };
-          };
-          immich = {
-            rule = "Host(`photo.hs.yanlincs.com`)";
-            service = "immich";
-            tls = {
-              certResolver = "cloudflare";
-              domains = [{
-                main = "*.hs.yanlincs.com";
-              }];
-            };
-          };
           syncthing = {
-            rule = "Host(`syncthing.hs.yanlincs.com`)";
+            rule = "Host(`syncthing.${config.networking.hostName}.yanlincs.com`)";
             service = "syncthing";
             tls = {
               certResolver = "cloudflare";
               domains = [{
-                main = "*.hs.yanlincs.com";
+                main = "*.${config.networking.hostName}.yanlincs.com";
-              }];
-            };
-          };
-          plex = {
-            rule = "Host(`plex.hs.yanlincs.com`)";
-            service = "plex";
-            tls = {
-              certResolver = "cloudflare";
-              domains = [{
-                main = "*.hs.yanlincs.com";
-              }];
-            };
-          };
-          sonarr = {
-            rule = "Host(`sonarr.hs.yanlincs.com`)";
-            service = "sonarr";
-            tls = {
-              certResolver = "cloudflare";
-              domains = [{
-                main = "*.hs.yanlincs.com";
-              }];
-            };
-          };
-          radarr = {
-            rule = "Host(`radarr.hs.yanlincs.com`)";
-            service = "radarr";
-            tls = {
-              certResolver = "cloudflare";
-              domains = [{
-                main = "*.hs.yanlincs.com";
-              }];
-            };
-          };
-          bazarr = {
-            rule = "Host(`bazarr.hs.yanlincs.com`)";
-            service = "bazarr";
-            tls = {
-              certResolver = "cloudflare";
-              domains = [{
-                main = "*.hs.yanlincs.com";
-              }];
-            };
-          };
-          qbittorrent = {
-            rule = "Host(`qbit.hs.yanlincs.com`)";
-            service = "qbittorrent";
-            tls = {
-              certResolver = "cloudflare";
-              domains = [{
-                main = "*.hs.yanlincs.com";
-              }];
-            };
-          };
-          paperless = {
-            rule = "Host(`paperless.hs.yanlincs.com`)";
-            service = "paperless";
-            tls = {
-              certResolver = "cloudflare";
-              domains = [{
-                main = "*.hs.yanlincs.com";
-              }];
-            };
-          };
-          rss = {
-            rule = "Host(`rss.hs.yanlincs.com`)";
-            service = "rss";
-            tls = {
-              certResolver = "cloudflare";
-              domains = [{
-                main = "*.hs.yanlincs.com";
-              }];
-            };
-          };
-          linkding = {
-            rule = "Host(`link.hs.yanlincs.com`)";
-            service = "linkding";
-            tls = {
-              certResolver = "cloudflare";
-              domains = [{
-                main = "*.hs.yanlincs.com";
-              }];
-            };
-          };
-          cloud = {
-            rule = "Host(`cloud.hs.yanlincs.com`)";
-            service = "cloud";
-            tls = {
-              certResolver = "cloudflare";
-              domains = [{
-                main = "*.hs.yanlincs.com";
               }];
             };
           };
         };
         services = {
-          homeassistant = {
-            loadBalancer = {
-              servers = [{
-                url = "http://localhost:8123";
-              }];
-            };
-          };
-          immich = {
-            loadBalancer = {
-              servers = [{
-                url = "http://localhost:5000";
-              }];
-            };
-          };
           syncthing = {
             loadBalancer = {
               servers = [{
@@ -204,69 +86,6 @@
               }];
             };
           };
-          plex = {
-            loadBalancer = {
-              servers = [{
-                url = "http://localhost:32400";
-              }];
-            };
-          };
-          sonarr = {
-            loadBalancer = {
-              servers = [{
-                url = "http://localhost:8989";
-              }];
-            };
-          };
-          radarr = {
-            loadBalancer = {
-              servers = [{
-                url = "http://localhost:7878";
-              }];
-            };
-          };
-          bazarr = {
-            loadBalancer = {
-              servers = [{
-                url = "http://localhost:6767";
-              }];
-            };
-          };
-          qbittorrent = {
-            loadBalancer = {
-              servers = [{
-                url = "http://localhost:8080";
-              }];
-            };
-          };
-          paperless = {
-            loadBalancer = {
-              servers = [{
-                url = "http://localhost:8001";
-              }];
-            };
-          };
-          rss = {
-            loadBalancer = {
-              servers = [{
-                url = "http://localhost:8002";
-              }];
-            };
-          };
-          linkding = {
-            loadBalancer = {
-              servers = [{
-                url = "http://localhost:9090";
-              }];
-            };
-          };
-          cloud = {
-            loadBalancer = {
-              servers = [{
-                url = "http://localhost:5001";
-              }];
-            };
-          };
         };
       };
     };
@@ -275,6 +94,13 @@
     environmentFiles = [ "/run/secrets/traefik-env" ];
   };
 
+  # Ensure Traefik can access Docker socket
+  systemd.services.traefik.serviceConfig = {
+    SupplementaryGroups = [ "podman" ];
+    # Mount Docker/Podman socket for service discovery
+    BindPaths = [ "/run/podman/podman.sock:/var/run/docker.sock" ];
+  };
+
   # Create environment file for Traefik Cloudflare credentials
   systemd.services.traefik-env-setup = {
     description = "Setup Traefik environment file";