Jo/puzzlevision
1
0
Fork 0
mirror of https://github.com/Jokiller230/puzzlevision.git synced 2025-10-31 13:50:04 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

fix(modules): update cloudflare API key usage in traefik

Browse source 
feat: add traefik configuration to absolutesolver
This commit is contained in:
Jo 2024-09-23 22:52:23 +02:00
parent 970c73e1c5
commit 7aa775d600
3 changed files with 27 additions and 14 deletions
Download patch file Download diff file Expand all files Collapse all files

26
modules/nixos/services/traefik/default.nix
View file

@ -7,25 +7,36 @@
let
cfg = config.${namespace}.services.traefik;
in {
options.${namespace}.services.traefik = { enable = mkEnableOption "Enable the Traefik service."; };
options.${namespace}.services.traefik = {
enable = mkEnableOption "Enable the Traefik service.";
cloudflareEmail = mkOption {
type = types.str;
default = "system@thevoid.cafe";
example = "system@thevoid.cafe";
description = "Specify the E-Mail associated with your Cloudflare account for ACME.";
};
};
config = mkIf cfg.enable {
networking.firewall.allowedTCPPorts = [80 443];
networking.firewall.allowedTCPPorts = [80 8080 443]; # http, dashboard, https
systemd.services.traefik = {
environment = {
CF_API_EMAIL = config.sops.secrets."cloudflare/api_email".path;
CF_API_KEY = config.sops.secrets."cloudflare/api_key".path;
CF_API_EMAIL = cfg.cloudflareEmail;
};
serviceConfig = {
EnvironmentFile = [config.sops.secrets."services/cloudflare/api_key".path];
};
};
services.traefik = {
enable = true;
group = "docker";
staticConfigOptions = {
log = {
level = "INFO";
filePath = "/var/log/traefik.log";
filePath = "/var/lib/traefik/traefik.log";
noColor = false;
maxSize = 100;
compress = true;
@ -46,12 +57,11 @@ in {
certificatesResolvers = {
letsencrypt = {
acme = {
email = "johannesreckers2006@gmail.com";
email = cfg.cloudflareEmail;
storage = "/var/lib/traefik/acme.json";
caServer = "https://acme-staging-v02.api.letsencrypt.org/directory";
dnsChallenge = {
provider = "cloudflare";
resolvers = ["1.1.1.1:53" "8.8.8.8:53"];
};
};
};
@ -96,7 +106,5 @@ in {
};
};
};
# Todo: continue with "traefik" configuration and test it on a running system
};
}

7
secrets/default.yaml
View file

@ -3,8 +3,7 @@ users:
password_hash: ENC[AES256_GCM,data:zHiVYdv7vQjW4yYWVyszNaHM40r5pp2CRIbcGRF9CcEoCSJnDF0LRDFoTAFGsnXLMgzpvai7nCNHksSW6NEsVubVeH0D7/ECbw==,iv:g+py8p9KF1Kds1mg7iUjMghoeapAo4738LxMrwXGEgc=,tag:tQsDWtspuWVU77jyEpgNYQ==,type:str]
services:
cloudflare:
api_email: ENC[AES256_GCM,data:n32V/74Kz7lSwCVYmwKrbSVdct/oLc9NcIZtvvk=,iv:HOe2unXoP+C+DliK0vGbkTNUWbQJvDwfWpNwqsIJHWM=,tag:sQT1fnjgRihkDUGJH4CnIA==,type:str]
api_key: ENC[AES256_GCM,data:uDh6rPtSx2B53x5xd1R1vNJTLyB2Bn5/vCkzIZnX0MSFQhiwSA==,iv:5rzKLF6h3uAFUWyh9oz2JmQFd4FTvQ7KCx6dgCvp2jg=,tag:NYB4oMI47AZDCmOlNH0ZrA==,type:str]
api_key: ENC[AES256_GCM,data:y2CdoiszYf0EHcFzlAUjBN5DINM/HA/2JxMoAvvybTCFQPBYyZnTgR/AqFTulqzv,iv:mIFWq9YetAwYIeXSonWtjx0diV02CBySNsKnmB0ZnYo=,tag:MH0rFfN9f1ZVMKnhTbQwww==,type:str]
sops:
kms: []
gcp_kms: []
@ -29,8 +28,8 @@ sops:
dnk2Z3N0YzU0eG5nbkkvZC8yQXJhWlEKKVGY0IyA9MMqzc+YohmHzKqHaf8z8t6Z
ag0TBf2uU2ZDiPfNhhDaUdltGiPrk+AlbHSTmrDwZ8T/+A8hHRyGYA==
-----END AGE ENCRYPTED FILE-----
lastmodified: "2024-09-22T15:10:16Z"
mac: ENC[AES256_GCM,data:BZfsnJDXxawuMzV0N2c4McnKWGq5wZky3vJZL9vMKwvffRqXyGJThaZxM7jGFL8Tv/OYdLD7YuH2TA6yVf4yK2fukXRbWlGMoAjtSVL6iXh6B8dn6jeDPyNwG/QSIDimRVj/dWCWgZWCG7+D72Dilj7lPohAVWNPKJR7C21jETk=,iv:Xbw3dbQfs32/6IDSwlRJU+NN2XzyQAfoijLQj/e4dao=,tag:BZYab9PYYg5CjUtXfBj6wA==,type:str]
lastmodified: "2024-09-23T20:38:08Z"
mac: ENC[AES256_GCM,data:vk/tLriUOoOwMeWuHhMAbgwLfTSpJBy8XJFJCf6e1mJ2ppmXZCzSU7/3WzYAyZyJdwaPNMJAjbg31jR35WODnvYB1L9HiDwxh16TKrGsLsjB1lghGPJ3HJIIGmSWJ3zPTgMu9fw2eIibbdBALfI2t0F4Uzga1vsnfuCRwxY2xEg=,iv:a2clWNJtBfngXZiJ4nutsjn6frLxGwWaP64t4fgKjqo=,tag:WFRUkHYswLj7I9kVtJWd9w==,type:str]
pgp: []
unencrypted_suffix: _unencrypted
version: 3.9.0

8
systems/x86_64-linux/absolutesolver/default.nix
View file

@ -21,7 +21,6 @@
sops.age.generateKey = true;
# Sops keys
sops.secrets."services/cloudflare/api_email" = {};
sops.secrets."services/cloudflare/api_key" = {};
# Set hostname
@ -37,6 +36,13 @@
# Set system configuration
puzzlevision = {
archetypes.server.enable = true;
services = {
traefik = {
enable = true;
cloudflareEmail = "johannesreckers2006@gmail.com";
};
};
};
# Configure users.