Jo/puzzlevision
1
0
Fork 0
mirror of https://github.com/Jokiller230/puzzlevision.git synced 2025-10-31 13:50:04 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

fix(modules): update cloudflare API key usage in traefik

Browse source 
feat: add traefik configuration to absolutesolver
This commit is contained in:
Jo 2024-09-23 22:52:23 +02:00
parent 970c73e1c5
commit 7aa775d600
3 changed files with 27 additions and 14 deletions
Download patch file Download diff file Expand all files Collapse all files

26
modules/nixos/services/traefik/default.nix
View file

@ -7,25 +7,36 @@
let let
cfg = config.${namespace}.services.traefik; cfg = config.${namespace}.services.traefik;
in { in {
options.${namespace}.services.traefik = { enable = mkEnableOption "Enable the Traefik service."; }; options.${namespace}.services.traefik = {
enable = mkEnableOption "Enable the Traefik service.";
cloudflareEmail = mkOption {
type = types.str;
default = "system@thevoid.cafe";
example = "system@thevoid.cafe";
description = "Specify the E-Mail associated with your Cloudflare account for ACME.";
};
};
config = mkIf cfg.enable { config = mkIf cfg.enable {
networking.firewall.allowedTCPPorts = [80 443]; networking.firewall.allowedTCPPorts = [80 8080 443]; # http, dashboard, https
systemd.services.traefik = { systemd.services.traefik = {
environment = { environment = {
CF_API_EMAIL = config.sops.secrets."cloudflare/api_email".path; CF_API_EMAIL = cfg.cloudflareEmail;
CF_API_KEY = config.sops.secrets."cloudflare/api_key".path; };
serviceConfig = {
EnvironmentFile = [config.sops.secrets."services/cloudflare/api_key".path];
}; };
}; };
services.traefik = { services.traefik = {
enable = true; enable = true;
group = "docker";
staticConfigOptions = { staticConfigOptions = {
log = { log = {
level = "INFO"; level = "INFO";
filePath = "/var/log/traefik.log"; filePath = "/var/lib/traefik/traefik.log";
noColor = false; noColor = false;
maxSize = 100; maxSize = 100;
compress = true; compress = true;
@ -46,12 +57,11 @@ in {
certificatesResolvers = { certificatesResolvers = {
letsencrypt = { letsencrypt = {
acme = { acme = {
email = "johannesreckers2006@gmail.com"; email = cfg.cloudflareEmail;
storage = "/var/lib/traefik/acme.json"; storage = "/var/lib/traefik/acme.json";
caServer = "https://acme-staging-v02.api.letsencrypt.org/directory"; caServer = "https://acme-staging-v02.api.letsencrypt.org/directory";
dnsChallenge = { dnsChallenge = {
provider = "cloudflare"; provider = "cloudflare";
resolvers = ["1.1.1.1:53" "8.8.8.8:53"];
}; };
}; };
}; };
@ -96,7 +106,5 @@ in {
}; };
}; };
}; };
# Todo: continue with "traefik" configuration and test it on a running system
}; };
} }

7
secrets/default.yaml
View file

@ -3,8 +3,7 @@ users:
password_hash: ENC[AES256_GCM,data:zHiVYdv7vQjW4yYWVyszNaHM40r5pp2CRIbcGRF9CcEoCSJnDF0LRDFoTAFGsnXLMgzpvai7nCNHksSW6NEsVubVeH0D7/ECbw==,iv:g+py8p9KF1Kds1mg7iUjMghoeapAo4738LxMrwXGEgc=,tag:tQsDWtspuWVU77jyEpgNYQ==,type:str] password_hash: ENC[AES256_GCM,data:zHiVYdv7vQjW4yYWVyszNaHM40r5pp2CRIbcGRF9CcEoCSJnDF0LRDFoTAFGsnXLMgzpvai7nCNHksSW6NEsVubVeH0D7/ECbw==,iv:g+py8p9KF1Kds1mg7iUjMghoeapAo4738LxMrwXGEgc=,tag:tQsDWtspuWVU77jyEpgNYQ==,type:str]
services: services:
cloudflare: cloudflare:
api_email: ENC[AES256_GCM,data:n32V/74Kz7lSwCVYmwKrbSVdct/oLc9NcIZtvvk=,iv:HOe2unXoP+C+DliK0vGbkTNUWbQJvDwfWpNwqsIJHWM=,tag:sQT1fnjgRihkDUGJH4CnIA==,type:str] api_key: ENC[AES256_GCM,data:y2CdoiszYf0EHcFzlAUjBN5DINM/HA/2JxMoAvvybTCFQPBYyZnTgR/AqFTulqzv,iv:mIFWq9YetAwYIeXSonWtjx0diV02CBySNsKnmB0ZnYo=,tag:MH0rFfN9f1ZVMKnhTbQwww==,type:str]
api_key: ENC[AES256_GCM,data:uDh6rPtSx2B53x5xd1R1vNJTLyB2Bn5/vCkzIZnX0MSFQhiwSA==,iv:5rzKLF6h3uAFUWyh9oz2JmQFd4FTvQ7KCx6dgCvp2jg=,tag:NYB4oMI47AZDCmOlNH0ZrA==,type:str]
sops: sops:
kms: [] kms: []
gcp_kms: [] gcp_kms: []
@ -29,8 +28,8 @@ sops:
dnk2Z3N0YzU0eG5nbkkvZC8yQXJhWlEKKVGY0IyA9MMqzc+YohmHzKqHaf8z8t6Z dnk2Z3N0YzU0eG5nbkkvZC8yQXJhWlEKKVGY0IyA9MMqzc+YohmHzKqHaf8z8t6Z
ag0TBf2uU2ZDiPfNhhDaUdltGiPrk+AlbHSTmrDwZ8T/+A8hHRyGYA== ag0TBf2uU2ZDiPfNhhDaUdltGiPrk+AlbHSTmrDwZ8T/+A8hHRyGYA==
-----END AGE ENCRYPTED FILE----- -----END AGE ENCRYPTED FILE-----
lastmodified: "2024-09-22T15:10:16Z" lastmodified: "2024-09-23T20:38:08Z"
mac: ENC[AES256_GCM,data:BZfsnJDXxawuMzV0N2c4McnKWGq5wZky3vJZL9vMKwvffRqXyGJThaZxM7jGFL8Tv/OYdLD7YuH2TA6yVf4yK2fukXRbWlGMoAjtSVL6iXh6B8dn6jeDPyNwG/QSIDimRVj/dWCWgZWCG7+D72Dilj7lPohAVWNPKJR7C21jETk=,iv:Xbw3dbQfs32/6IDSwlRJU+NN2XzyQAfoijLQj/e4dao=,tag:BZYab9PYYg5CjUtXfBj6wA==,type:str] mac: ENC[AES256_GCM,data:vk/tLriUOoOwMeWuHhMAbgwLfTSpJBy8XJFJCf6e1mJ2ppmXZCzSU7/3WzYAyZyJdwaPNMJAjbg31jR35WODnvYB1L9HiDwxh16TKrGsLsjB1lghGPJ3HJIIGmSWJ3zPTgMu9fw2eIibbdBALfI2t0F4Uzga1vsnfuCRwxY2xEg=,iv:a2clWNJtBfngXZiJ4nutsjn6frLxGwWaP64t4fgKjqo=,tag:WFRUkHYswLj7I9kVtJWd9w==,type:str]
pgp: [] pgp: []
unencrypted_suffix: _unencrypted unencrypted_suffix: _unencrypted
version: 3.9.0 version: 3.9.0

8
systems/x86_64-linux/absolutesolver/default.nix
View file

@ -21,7 +21,6 @@
sops.age.generateKey = true; sops.age.generateKey = true;
# Sops keys # Sops keys
sops.secrets."services/cloudflare/api_email" = {};
sops.secrets."services/cloudflare/api_key" = {}; sops.secrets."services/cloudflare/api_key" = {};
# Set hostname # Set hostname
@ -37,6 +36,13 @@
# Set system configuration # Set system configuration
puzzlevision = { puzzlevision = {
archetypes.server.enable = true; archetypes.server.enable = true;
services = {
traefik = {
enable = true;
cloudflareEmail = "johannesreckers2006@gmail.com";
};
};
}; };
# Configure users. # Configure users.