Add selfhosted services

2026-06-30 04:26:40 +03:00
parent f212c874b5
commit 13e407847f
78 changed files with 2346 additions and 690 deletions
@@ -0,0 +1,118 @@
+{ config, ... }:
+let
+  common = config.selfhosted.common;
+  cfg = config.selfhosted.netbird;
+in
+{
+  sops.templates."traefik.env".content = ''
+    TRAEFIK_CERTIFICATESRESOLVERS_LETSENCRYPT_ACME_EMAIL=${config.sops.placeholder."letsEncrypt/email"}
+  '';
+
+  sops.templates."traefik-static-config.yaml".content = ''
+    entryPoints:
+      web:
+        address: ":80"
+        http:
+          redirections:
+            entrypoint:
+              to: websecure
+              scheme: https
+      websecure:
+        address: ":443"
+        allowACMEByPass: true
+        transport:
+          respondingTimeouts:
+            readTimeout: 0
+            writeTimeout: 0
+            idleTimeout: 0
+        proxyProtocol:
+          trustedIPs:
+            - "${common.network.address}/${common.network.mask}"
+    
+    serversTransport:
+      forwardingTimeouts:
+        responseHeaderTimeout: 0
+        idleConnTimeout: 0
+    
+    providers:
+      docker:
+        exposedByDefault: false
+        network: "${common.network.name}"
+      file:
+        filename: /etc/traefik/dynamic.yaml
+        watch: true
+
+    certificatesResolvers:
+      letsencrypt:
+        acme:
+          storage: /letsencrypt/acme.json
+          tlsChallenge: true
+  '';
+
+  sops.templates."traefik-dynamic-config.yaml".content = ''
+    http:
+      routers:
+        netbird-dashboard:
+          entryPoints:
+            - websecure
+          rule: "Host(`${cfg.subdomain}.${config.sops.placeholder."domains/serv"}`)"
+          service: dashboard
+          priority: 1
+          tls:
+            certResolver: letsencrypt
+
+        netbird-backend:
+          entryPoints:
+            - websecure
+          rule: "Host(`${cfg.subdomain}.${config.sops.placeholder."domains/serv"}`) && (PathPrefix(`/relay`) || PathPrefix(`/ws-proxy/`) || PathPrefix(`/api`) || PathPrefix(`/oauth2`))"
+          service: netbird-server
+          priority: 100
+          tls:
+            certResolver: letsencrypt
+
+        netbird-grpc:
+          entryPoints:
+            - websecure
+          rule: "Host(`${cfg.subdomain}.${config.sops.placeholder."domains/serv"}`) && (PathPrefix(`/signalexchange.SignalExchange/`) || PathPrefix(`/management.ManagementService/`))"
+          service: netbird-server-h2c
+          priority: 100
+          tls:
+            certResolver: letsencrypt
+
+      services:
+        dashboard:
+          loadBalancer:
+            servers:
+              - url: "http://${cfg.dashboard.name}:80"
+        netbird-server:
+          loadBalancer:
+            servers:
+              - url: "http://${cfg.server.name}:80"
+        netbird-server-h2c:
+          loadBalancer:
+            servers:
+              - url: "h2c://${cfg.server.name}:80"
+    tcp:
+      serversTransports:
+        pp-v2:
+          proxyProtocol:
+            version: 2
+
+      routers:
+        proxy-passthrough:
+          entrypoints:
+            - websecure
+          rule: HostSNI(`*`)
+          service: proxy-tls
+          priority: 1
+          tls:
+            passthrough: true
+
+      services:
+        proxy-tls:
+          loadBalancer:
+            serversTransport: pp-v2@file
+            servers:
+              - address: "${cfg.proxy.name}:8443"
+  '';
+}
@@ -0,0 +1,72 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+with lib;
+let
+  common = config.selfhosted.common;
+  cfg = config.selfhosted.traefik;
+  hostDataPath = "${common.dataDir}/traefik";
+in
+{
+  imports = [ ./config.nix ];
+
+  options.selfhosted.traefik = {
+    name = mkOption {
+      type = types.str;
+    };
+    ip = mkOption {
+      type = types.str;
+    };
+  };
+
+  config = {
+    sops.secrets = {
+      "domains/serv" = { };
+      "letsEncrypt/email" = { };
+    };
+
+    virtualisation.oci-containers.containers.${cfg.name} = {
+      image = "traefik:latest";
+      environmentFiles = [ config.sops.templates."traefik.env".path ];
+      volumes = [
+        "/var/run/docker.sock:/var/run/docker.sock:ro"
+        "${config.sops.templates."traefik-static-config.yaml".path}:/etc/traefik/traefik.yaml:ro"
+        "${config.sops.templates."traefik-dynamic-config.yaml".path}:/etc/traefik/dynamic.yaml:ro"
+        "${hostDataPath}/letsencrypt:/letsencrypt:rw"
+      ];
+      ports = [
+        "0.0.0.0:80:80"
+        "0.0.0.0:443:443"
+      ];
+      cmd = [
+        "--log.level=INFO"
+        "--accesslog=true"
+        "--configfile=/etc/traefik/traefik.yaml"
+      ];
+      log-driver = "journald";
+      extraOptions = [
+        "--ip=172.30.0.10"
+        "--network-alias=${cfg.name}"
+        "--network=${common.network.name}"
+      ];
+    };
+
+    systemd.services."${common.backend}-${cfg.name}" = {
+      serviceConfig = {
+        Restart = lib.mkOverride 90 "always";
+      };
+      after = [ "${common.backend}-network-${common.network.name}.service" ];
+      requires = [ "${common.backend}-network-${common.network.name}.service" ];
+      partOf = [ "${common.backend}-${common.rootTarget.name}.target" ];
+      wantedBy = [ "${common.backend}-${common.rootTarget.name}.target" ];
+      preStart = ''
+        mkdir -p ${hostDataPath}/letsencrypt
+        chown -R ${common.user.uid}:${common.group.gid} ${hostDataPath}
+        chmod -R 0600 ${hostDataPath}
+      '';
+    };
+  };
+}