aloslider
119 lines
3.1 KiB
Nix
119 lines
3.1 KiB
Nix
{ config, ... }:
|
|
let
|
|
common = config.selfhosted.common;
|
|
cfg = config.selfhosted.netbird;
|
|
in
|
|
{
|
|
sops.templates."traefik.env".content = ''
|
|
TRAEFIK_CERTIFICATESRESOLVERS_LETSENCRYPT_ACME_EMAIL=${config.sops.placeholder."letsEncrypt/email"}
|
|
'';
|
|
|
|
sops.templates."traefik-static-config.yaml".content = ''
|
|
entryPoints:
|
|
web:
|
|
address: ":80"
|
|
http:
|
|
redirections:
|
|
entrypoint:
|
|
to: websecure
|
|
scheme: https
|
|
websecure:
|
|
address: ":443"
|
|
allowACMEByPass: true
|
|
transport:
|
|
respondingTimeouts:
|
|
readTimeout: 0
|
|
writeTimeout: 0
|
|
idleTimeout: 0
|
|
proxyProtocol:
|
|
trustedIPs:
|
|
- "${common.network.address}/${common.network.mask}"
|
|
|
|
serversTransport:
|
|
forwardingTimeouts:
|
|
responseHeaderTimeout: 0
|
|
idleConnTimeout: 0
|
|
|
|
providers:
|
|
docker:
|
|
exposedByDefault: false
|
|
network: "${common.network.name}"
|
|
file:
|
|
filename: /etc/traefik/dynamic.yaml
|
|
watch: true
|
|
|
|
certificatesResolvers:
|
|
letsencrypt:
|
|
acme:
|
|
storage: /letsencrypt/acme.json
|
|
tlsChallenge: true
|
|
'';
|
|
|
|
sops.templates."traefik-dynamic-config.yaml".content = ''
|
|
http:
|
|
routers:
|
|
netbird-dashboard:
|
|
entryPoints:
|
|
- websecure
|
|
rule: "Host(`${cfg.subdomain}.${config.sops.placeholder."domains/serv"}`)"
|
|
service: dashboard
|
|
priority: 1
|
|
tls:
|
|
certResolver: letsencrypt
|
|
|
|
netbird-backend:
|
|
entryPoints:
|
|
- websecure
|
|
rule: "Host(`${cfg.subdomain}.${config.sops.placeholder."domains/serv"}`) && (PathPrefix(`/relay`) || PathPrefix(`/ws-proxy/`) || PathPrefix(`/api`) || PathPrefix(`/oauth2`))"
|
|
service: netbird-server
|
|
priority: 100
|
|
tls:
|
|
certResolver: letsencrypt
|
|
|
|
netbird-grpc:
|
|
entryPoints:
|
|
- websecure
|
|
rule: "Host(`${cfg.subdomain}.${config.sops.placeholder."domains/serv"}`) && (PathPrefix(`/signalexchange.SignalExchange/`) || PathPrefix(`/management.ManagementService/`))"
|
|
service: netbird-server-h2c
|
|
priority: 100
|
|
tls:
|
|
certResolver: letsencrypt
|
|
|
|
services:
|
|
dashboard:
|
|
loadBalancer:
|
|
servers:
|
|
- url: "http://${cfg.dashboard.name}:80"
|
|
netbird-server:
|
|
loadBalancer:
|
|
servers:
|
|
- url: "http://${cfg.server.name}:80"
|
|
netbird-server-h2c:
|
|
loadBalancer:
|
|
servers:
|
|
- url: "h2c://${cfg.server.name}:80"
|
|
tcp:
|
|
serversTransports:
|
|
pp-v2:
|
|
proxyProtocol:
|
|
version: 2
|
|
|
|
routers:
|
|
proxy-passthrough:
|
|
entrypoints:
|
|
- websecure
|
|
rule: HostSNI(`*`)
|
|
service: proxy-tls
|
|
priority: 1
|
|
tls:
|
|
passthrough: true
|
|
|
|
services:
|
|
proxy-tls:
|
|
loadBalancer:
|
|
serversTransport: pp-v2@file
|
|
servers:
|
|
- address: "${cfg.proxy.name}:8443"
|
|
'';
|
|
}
|