85 lines
2.2 KiB
Nix
85 lines
2.2 KiB
Nix
# NOTE: environment file at: `/etc/traefik-env` with mode 600
|
|
# content (for Cloudflare API):
|
|
# CF_API_EMAIL=your-email@example.com
|
|
# CF_DNS_API_TOKEN=your-cloudflare-api-token
|
|
|
|
{ config, pkgs, lib, ... }:
|
|
|
|
{
|
|
# Traefik reverse proxy service
|
|
services.traefik = {
|
|
enable = true;
|
|
|
|
# Static configuration
|
|
staticConfigOptions = {
|
|
# Enable Docker provider for automatic service discovery
|
|
providers.docker = {
|
|
endpoint = "unix:///var/run/docker.sock";
|
|
exposedByDefault = false; # Only expose containers with traefik.enable=true
|
|
network = "podman"; # Use podman network
|
|
};
|
|
# Entry points for HTTP and HTTPS
|
|
entrypoints = {
|
|
web = {
|
|
address = ":80";
|
|
http.redirections.entrypoint = {
|
|
to = "websecure";
|
|
scheme = "https";
|
|
permanent = true;
|
|
};
|
|
};
|
|
websecure = {
|
|
address = ":443";
|
|
transport.respondingTimeouts.readTimeout = "0s";
|
|
};
|
|
};
|
|
|
|
# Certificate resolver using Cloudflare DNS challenge
|
|
certificatesResolvers.cloudflare = {
|
|
acme = {
|
|
email = "cloudflare@yanlincs.com";
|
|
storage = "/var/lib/traefik/acme.json";
|
|
dnsChallenge = {
|
|
provider = "cloudflare";
|
|
delayBeforeCheck = 60;
|
|
resolvers = [
|
|
"1.1.1.1:53"
|
|
"8.8.8.8:53"
|
|
];
|
|
};
|
|
};
|
|
};
|
|
|
|
# API and dashboard
|
|
api = {
|
|
dashboard = true;
|
|
debug = false;
|
|
};
|
|
|
|
# Logging
|
|
log = {
|
|
level = "INFO";
|
|
};
|
|
accessLog = {};
|
|
|
|
# Global settings
|
|
global = {
|
|
checkNewVersion = false;
|
|
sendAnonymousUsage = false;
|
|
};
|
|
};
|
|
|
|
# Dynamic configuration is now defined in host-specific proxy.nix files
|
|
# and will be merged with this base configuration
|
|
|
|
# Environment variables for Cloudflare
|
|
environmentFiles = [ "/etc/traefik-env" ];
|
|
};
|
|
|
|
# Ensure Traefik can access Docker socket
|
|
systemd.services.traefik.serviceConfig = {
|
|
SupplementaryGroups = [ "podman" ];
|
|
# Mount Docker/Podman socket for service discovery
|
|
BindPaths = [ "/run/podman/podman.sock:/var/run/docker.sock" ];
|
|
};
|
|
}
|