✨♻️ Migrate and refactor all v1 services, Add atticd service and cleanup

modules/nixos/services/traefik/default.nix

@@ -0,0 +1,98 @@
+{
+  lib,
+  self,
+  config,
+  ...
+}: let
+  inherit (lib) mkEnableOption mkIf mkOption;
+  inherit (self) namespace;
+
+  cfg = config.${namespace}.services.traefik;
+in {
+  options.${namespace}.services.traefik = {
+    enable = mkEnableOption "the Traefik service.";
+    sopsFile = mkOpt types.str null "The location of the sops secret file for the Traefik service.";
+    sopsFormat = mkOpt types.str null "The format of the sops secret file for the Traefik service.";
+  };
+
+  config = mkIf cfg.enable {
+    networking.firewall.allowedTCPPorts = [80 8080 443]; # http, dashboard, https
+
+    sops.secrets."services/traefik" = {
+      sopsFile = cfg.sopsFile;
+      format = cfg.sopsFormat;
+    };
+
+    systemd.services.traefik = {
+      serviceConfig = {
+        EnvironmentFile = [config.sops.secrets."services/traefik".path];
+      };
+    };
+
+    services.traefik = {
+      enable = true;
+      group = "docker";
+
+      staticConfigOptions = {
+        log = {
+          level = "INFO";
+          filePath = "/var/lib/traefik/traefik.log";
+          noColor = false;
+          maxSize = 100;
+          compress = true;
+        };
+
+        api = {
+          dashboard = true;
+          insecure = true;
+        };
+
+        providers = {
+          docker = {
+            exposedByDefault = false;
+            network = "proxy";
+          };
+        };
+
+        certificatesResolvers = {
+          letsencrypt = {
+            acme = {
+              email = cfg.cloudflareEmail;
+              storage = "/var/lib/traefik/acme.json";
+              #caServer = "https://acme-staging-v02.api.letsencrypt.org/directory"; # Uncomment this when testing stuff!
+              dnsChallenge = {
+                provider = "cloudflare";
+              };
+            };
+          };
+        };
+
+        entryPoints.web = {
+          address = ":80";
+          http.redirections.entryPoint = {
+            to = "websecure";
+            scheme = "https";
+            permanent = true;
+          };
+        };
+
+        entryPoints.websecure = {
+          address = ":443";
+          http.tls = {
+            certResolver = "letsencrypt";
+            domains = [
+              {
+                main = "thevoid.cafe";
+                sans = ["*.thevoid.cafe"];
+              }
+              {
+                main = "rhysbot.co.uk";
+                sans = ["*.rhysbot.co.uk"];
+              }
+            ];
+          };
+        };
+      };
+    };
+  };
+}