From 7c2fec71ae3be2d60753023c6e10d0088f43a836 Mon Sep 17 00:00:00 2001 From: Dmitriy Pleshevskiy Date: Sat, 4 Mar 2023 23:22:03 +0300 Subject: [PATCH] machines/magenta: add traefik --- .agenix_config.nix | Bin 4017 -> 4123 bytes machines/magenta/default.nix | 3 +- machines/magenta/services/gitea.nix | 30 +++++++++- .../services/mailserver-accounts.secret.nix | Bin 1087 -> 1122 bytes machines/magenta/services/mailserver.nix | 14 +++++ .../{modules => magenta/services}/nginx.nix | 4 +- machines/magenta/services/traefik.nix | 54 ++++++++++++++++++ secrets/traefik-dashboard-basicauth-users.age | Bin 0 -> 1366 bytes 8 files changed, 101 insertions(+), 4 deletions(-) rename machines/{modules => magenta/services}/nginx.nix (60%) create mode 100644 machines/magenta/services/traefik.nix create mode 100644 secrets/traefik-dashboard-basicauth-users.age diff --git a/.agenix_config.nix b/.agenix_config.nix index 70914c7cfa4c8fcd36506151100ae72a9bc93999..13c7930e42be92a31f72595f0899ca576e40c68a 100644 GIT binary patch literal 4123 zcmV+$5ajOwM@dveQdv+`0J*DJ(&lTf?`z~$rF*|DcPE`==nQg68Se4XNPl!POoYy! z7j!>Y+1j7P!Xp;dw6+Y(`7Pu(^q~d6|nRdGkm7 z=&!bb<~>4h8InCV2uYR)s6~Pc?I&arn$W5NAz6pSK+i(OPSfp~Ci}6Xmt7K| zIJw;TO>rPqE==*Y74)bAByCnPFDbUr_h(4q4myzr0$#CeNGXrUqlIUZNe1jMQ4`Xv zCbriK}HHL^zV4ER&A;f3n&XnT?~!y z-P)IB6SJBWU=6Ytq^p_zpQ}LLTLFh71N>^Q!w*;JJy>?u>HM|-s2H5I9}eL z%rq?h*LyZ7{jiAF3hy*3)SWb2sF;*zpkj>Gx}DQx2QrrTt&3)ZL;@)6H8~O2m&SMG z7ef9M{+qDNs_jp|^I=k6%97{(6f>|$4GBX+lA;i%k!@UR0CI8g0SgHdNaYEH|FcgO z5uXy7z(TNuUp%TWs<-oGpV_}6@+(DfbIAebbiv0L-pL6fuH&_2zCI4=lx}zTJsGO&8R?`-%1Z z#Uql*QRhV_c24WN=lcmU*(!P*l{hr*grRarx7r&U2wKO@4<$BDN4KId`YsUw0o`M)&B1hjowU*TiIW9~#4Er`$yb1_`Y=^NO6Oo%)iq#6M^ zLCm}|`{U%}@qO{jGcCfW)uNZ}`KCZVu2Nq|ENP65B4f=~{;4Z+Dtt*FbG=5=2!F5{HIB$VqhTu9Uru4f4Du8Z>F|%6-dslP467 zdaA6$wOE*OmmTQu_y!l z<8ew${;glz1KP!6#UrkDy0z5nPF@BwGHQjEwZixy-?WTw|;L`QD$o-V2n|Q z`!*HLcRH8oV3W*E?Z*6Q{<+8T+=D$m`zE&)+J`{?zKXFw*ka9MV{m^}c#6(k(%BN6 z!tQ$6xDS;?lDOA}@kn@{X+Kzw8DyY(tE?+Q@sr)fr%J#Qu*1=^8J|OC_^hTGnQm6V zO<9S<$5}Jyg2?@Iv9aK(ESf-scDIflSp49L3-9pwOJEK&s-n*A2CPTB3UnlZafik*-B&8ZS>EiIxqwS5GrG3^8&@7mh|I0{1Zmy9X;nPOW z{ApuypA8kXN{1QLadm{2qFM=Ug}NUU+`0Qkclz4=wS$9)6KJ+wt`p~gb#6AX^&o>| zegicbw-gbCG^*_7h0`injdkkIh&Tm!d?E+FL;6o|O2(%KFoD~B3m3*5$x)Fk1p8>d z;Nw9si32538!Q%IYrA|gnA@a<0}?cve5z~#l4X?lAInOR6ti7*N)->8b{oDS;0zJ( zmHO9lU)Ucn)JBgY5~4zvO{kldwlVwtrCV~nZ$XX1gUK)yXm&O`kCF0)WysLSKWcc)#1O5*b4XpvFh!mr!A!r-aI#+ z&9Sj1?*B^xmb|ojJq;gQa|GM9>qH9}E2hfQ-OAX>Pq&h}!*_X|yb#ZTJnRyIqprWp%J9-yiy-h?JI>3N>tWNdIkhKGndk}HF z(6Ic@H1L*5nE)R-hRP0Xp0wy&r7|1+8d5qW^DP<@P>t{@dIT^>gj1f zzE=bVQRsZFiu_6F460RI$$`?ayR)5lS!n^X@W@N>Qa)TOLwUS{xua`LtmC4oWOZuc zV!qL5+qAbEC;b$gJ0iMGFw;zy$gf*n>~ZYeZdlB8T?%)8PsOwd4@V;0;H0MXA*8wZ z<`k~4E(3YN>lBu_GFwvK#u4lq+7d_TyX>Q4&FiyQKhlnbE;AGH6p2wO?txCM%Ci+X z;_0K?dD|JC(P5T#pw>O{!%}T zF?2O_q*_g@5tRuw^QehUe=wd7CGqp*mehse&iFxzN-51+BT-n%M`k-J(vmco4yrxo zLM~N_PY?Kx;^=NJK$bzHx7kN=PT-B{)fru4ku-M^0$a$km+<^|WCu#IXSIaQCZ|JiQ z2r9jvdY8*QbfnVcW?1K#tLZbbV892-xJX`~M71guG|3(w`V6CmMBhUEiQ}Uk9lMGP zzE)mi4<=&oxml5V_P||YpkCGmZcB!zYNLB)D=1%Hh#Sq~xltS5fsTljH74VPThb*5 z8b`?*F=CgT&KkN2!t)sbOBvAxgqbosz!VE|pY*+n!x9}5k3X2ZK_1z1W|oAuGw*84 zx9ZY+6f^U=&`H-s&odJ>Go$@)TjuIQU;a$c+5)8bP;8r|ZsLe~07MwFa&WC$r~-Ta z11Xw8^w@#p#{CE#nfIo6I?{|u433R&OEuZaAzKMqXkS%O# zEFc(ogCk0k?lIQnjbM>QNSbVPpLl)`8x_?Ee#X1~VpzJ+7$Q`?$kB*@fZ$qHytBj1 zhREzV17-YgUNTS_AWyeRhI7v=C{c08n=37KG1Iu?pDiqR$J8k~?yI_5Uv0n#zt8`( z6s18($$VTEPF=d?+YLe?$Z$y{x^cCtC46WdlMwee5s4R0d-L#fxEj&5pkw9z0UIo9!sK@E~jBP;@o0|XwHx1>}DH0aKBnanIBVojC*k~jTkwiUXL5( zgMnRmr#7U7_B)h&(jGVht$`xZ$qe2mz83Q4U2-9+nB_GUxUv<7)QxmQHyMk$ULgET zWe&om1*Wvg{JQM);w;kIrvuGq(w#%ez%8{#CrN0$IHKbX>=ilQ|lXN1R_&z8?O46XTW$!%1(?;Re5DAG3z^?($_mC*ei#2D9kT^UPO+Xv3B-O zYtR9|Zh;tb952U60xyQm_OOFgTX&eN!j!mgxkhPR&z^TmW3dSoDLA!?$E#jMLL z$4I7!slt0`kd*N&oM-9{a}Io^n4U27pC`{#67xuaIJo!4xu*h+q#GCgB0ER9(c&A2 z%0l(>@eLyFx`lWT7;w6+p=8;NMR!t1V-f1I;T#l@sAy+DnRJyX7*#cq6qW&Q&-(3Q zvvOMd4=QN*3Smtvz-NW@xsx>o1xmTiV{goCWof?uL)U6ad+6${`X;sGYTvCZ!J!|wyefq`3!?^dPkK&}S9DVu7 z-oWbhmR>XCtAq625JPPo1wu;40LI9x&^^W08ztvIC(&YpT0a8bG;Mt)MdxW2)*%2yN+zM*HE;ce~CJUOkz942zK)hHy`EmdN literal 4017 zcmV;i4^Hp^M@dveQdv+`0A^yTtI|a&NG@zLpOs3(DcaF?NukGfYkXDF$cs~AR3$$R ztoP%Q3SmkV_k+^V0=FE@)ItX5fpt0ZVgs^foUz2LN z*)*wRaa??)JOKaZ(7XUGu<gQr7U zgZ5UHc!?r7n@kC_pOul*_JSPcZ~=pnXuLcPjj?7*^<7FcR(}i)f@cZtBd(f%-Ad4u zMsZzvaBbe!ZlvwTwPcFB#pxtAam?F`{5Gk8YYEZUM5D;FTKFvfOoUClOPX4^MW5HW zPBhK}^Poi_7f^e^Q?*Y$HS6S_>Yu}{et*aTqOb@b88a|Utvy}53w+{JXcjdnmJ=g? zRluKg>LLLGp-eMjjY53=PI(8Ir`!7FdNn_m)pgLczAPUw)3*udAVflIoS@z%fLS^lac5a3l206nf!bFE^~5e@y;OGxg~n& zRXin)`p4LK`H|<~o>=#QthS86mzds@X+#mXgSgM`@Fh6l>Y_jYn9+cvvBZ@j zO_OYt#V7_{TMi&L1|r?c6cM3du+F7cS&y|0hDHMOdi3Hew*GBjjU1PWSTG-hf5#uk z&HHrOz<$+Mwb&;;W4R9sVM!sT8ZCGO@<$SL2PU8_Db5XgTfa#%*7kwFpl( z@mt>_wY)`@fHRu>mL{u^PwIYkpmN`G*b{zQax-wxZZ?Hygw3C9iX7HEawNncl^hL& zPr|&S>Oflb&#&@nTujBY4$Z{If<08UyJW1>5K=E!m8eg$oX%UUN_VQQ(5cU-rcH9$ zgSm9K>b1FpmO_w383Jq+xkGo#LB1o=K~z{6Q&t!-2?%kHNu4rlUlJarMXpBkFd<32`AKI^9HAOVD}@d z%;YCMO!?68>#A=^i20fH8~#QHNK4v((L{$ z;l8qnEF%;{{G4x=EFJRi6m5JRc}aie-oc(qIW6^ zi|P!G{?O2#qxqWGWv1&=k!YK2MnV(xR+m0K>O0(*lws?A6z}ZD#_nzhz7OzMd&BfM~sE+*<-~Sf5sf^Y-hpw=!4!ZgfUdTjG2czQh}HF{2&1AS)kV( z_p568O}5LX75feJ13q|{Nx{< zsfL@>9pi$7W^KT8z?zH*6*G0SKQq7)HJ&(-vG4aqs1_rC!;=w^Z3=RN)O=Mt0Lt)< z_Ey{Ka;I#kgw_#>+mXpkcFtd+Zw(J}PArZVg=iLQWw`;{V-2Yk^P>V@D=?!B4X^Js zVIxOn$B5D^1-VfuS3`DLO(VdT`sN10LA8~B!@G^_XhijRep8LrIl){6?;KMqSbI6v{PL~h&PJhXPYz7# z=UA)92{XD$q2XZOAh#3`*@K76GNP741?oR8Y%%3&fYdIJ5 z_jb+obMSiCZW0{G)Y&d`?PgJLo@aidw#-`-f0k~x9@fJA&^y($(azUxwZ z|BIjsDoY>a1?erz3Uw2T(Oe>1b`kVKq@n<$H0Bq8XPl@pOT-juN%@kZ32 z;8rOB!E>Xv+9KwPY42<*Hu@Iqxb#T*$}XiY{#hZn-&Oh4X*UiZ4{TgTUE`?0qIBo7gs3;oM#tU7UdFsdg&OWM3Hl zZw{X%5IL{s^?Tu0muY6b03KvuM)~UG(K}=78Q4tRa{+l7Z$&~0;sH}G7nzgBJi~)& z45>Q}cl#N^BE6B1Dr$ti7ju)(#e$ox+v11zH|omBYMmwf48v>l%Uk;BM4o!V9&}UB z-2vS5mQ{BcAc2r5!Gp`uE;POUbC&+6k2tqOD_bhhoJX_WK7~u`?UZDt_9XSb{O0Y0 zlmuNdFGEQ36=w_PL_5TkW*jpusq#x2OwXT5A%G8fZTU`1-L|V>=JQBxHk$%nYwYt4 z+{SIR-l^I$Da;aj`1q-L^T~hp*Z#V`weUESkWv)N3Ud zK(*Y$^V_2|9`c4Vjv|nU?r)9Mmahn1{cl3?Wlb3GP#z(|sf@rlIAS`OsN|!6G;N0m zIn|gM7+_jSU8ke0*Ow?gE_ksetE&H9y}@u~@)AXSRD%v!1M!II_&O}RzV7z08G&*Y zh8ZLQ7>5prg-d-*sgC*K2<-OGi|Xd6#(r_uawAI0$A-l)Pntc9qUZtlrJE20|Al_XHXu%#U7aVeHsr*(Hz6k_ zN)7j_+ocMoCh88vgYt=Hz0QbQKVewtD~i&DVXiLpl~NfHTmo8~@1>ODe3bBL?zzh} zKG~hNL;K#ET@x>k*Ovs4;mttJT5$CJ2s{)87pE%(V)_ zm(O$GEyZcSb%y-DpH*ppq=fm1sBl(h6rlCry{_E(gQPp)*>=j9jlSSBOPj(z@{RbeD^yZKO1R&p}xmI{hK}`nZo8mI$V-Oh=(bUqe_SF>j+z zgfGfu*=%tD1J(8Wb?5V*&`Y54#+2t!s{C(21K{ZMzAz-@iFzE-vKV(qF0Ya}*yW3t zqFzp}$LEW^PE@opm1Xs2b2c%Xr&D;J7U~^p9#J0tb)Jyja*Xj7xrz@+1x~^PZ{5vQ z;92dbU6BzK9Rrfp4#f28fw(MK>|6Mnf$YALkJvB$sv?R50H#cFDLf?jIEB`G8{7i0<7BE!(7hsx)S zD>;raR_11t*`AFHeJ)A;Y~^hhE4)706Cv){E~bZ*S|dgHl%lp?rZ9WOJWwbDYfg_V z0nyO(tbdAq`~=wPrCL)AwC3Mc-k79r_>4&}tL(vxQ5`m)p#K(Zu8iA%Ch%R0)Dv3x z#_(eRscqU6{E8eviGJctkx{)5ZYA`bT0l7S9LA?O8M0ey-BaYFSNcY4o*L=a(?tIL z1?0~=c(>hZU2l87XDm64u+Wvaxr!K3O>6l3ddN|UG~n4GC=q=VVplg^O_ESnR!N7D z{Zb>VIi(#Lz0hULU)onDWMSszMN0# z{`ofm@D$d~dLzb159@ZSq1xFNKcgi--AW(?8x9;1PKZX`1>%V?o-e!Coa%9~Z@=%C zoi(hv2DmciAzjiUCd=!pc$8_8_tS%+ag8&;Tk=nD&g1mSCr>dJS6dy&L6Q%i&?BQ}N=c9*9@>DswCZR@H}J);A!bYNK|NPssdeJQ2CyR}%6{||jl6kiZ<%(K Xdq>YUMJO@z^+nh#H@CV5$p{4jB#hHG diff --git a/machines/magenta/default.nix b/machines/magenta/default.nix index 7a4ec9c..c1a206d 100644 --- a/machines/magenta/default.nix +++ b/machines/magenta/default.nix @@ -10,9 +10,10 @@ in ../modules/common.nix ../modules/nix.nix - ../modules/nginx.nix ../modules/fail2ban.nix + ./services/nginx.nix + ./services/traefik.nix ./services/mailserver.nix ./services/gitea.nix ]; diff --git a/machines/magenta/services/gitea.nix b/machines/magenta/services/gitea.nix index 206fba2..c478924 100644 --- a/machines/magenta/services/gitea.nix +++ b/machines/magenta/services/gitea.nix @@ -9,6 +9,8 @@ let User-agent: * Disallow: /github ''; + + magentaData = import ../data.secret.nix; in { services.postgresql.package = pkgs.postgresql_14; @@ -104,11 +106,35 @@ in cp -f ${robotsTxt} ${giteaCfg.stateDir}/custom/robots.txt ''; - services.nginx.virtualHosts.${hostname} = { + services.traefik.dynamicConfigOptions.http = { + routers = { + to_gitea_http = { + rule = "Host(`${hostname}`)"; + entryPoints = [ "http" ]; + middlewares = [ "https_redirect" ]; + service = "noop@internal"; + }; + to_gitea_https = { + rule = "Host(`${hostname}`)"; + entryPoints = [ "https" ]; + tls.certResolver = "le"; + service = "gitea"; + }; + }; + services.gitea = { + loadBalancer.servers = [ + { url = "http://localhost:${toString giteaCfg.httpPort}"; } + ]; + }; + }; + + /* + services.nginx.virtualHosts.${hostname} = { enableACME = true; forceSSL = true; locations."/".proxyPass = "http://localhost:${toString giteaCfg.httpPort}/"; - }; + }; + */ age.secrets.gitea-smtp-passfile = { file = ../../../secrets/gitea-smtp-passfile.age; diff --git a/machines/magenta/services/mailserver-accounts.secret.nix b/machines/magenta/services/mailserver-accounts.secret.nix index ccc70baab04dbebdc6770d0f2f18e93c18b67485..d26568644cacf7049a6676fa6fc60b48b6e46d6d 100644 GIT binary patch literal 1122 zcmV-o1fBZ;M@dveQdv+`0Pve>kef#r;4Am0iXq=TspE)AUQ*9(OzgXGioniidSg2$ z?aO)R91_;iQqCL4i;}9TRWwvXOzdVssDT=2NY^ zS?~gDVK@9F*GV5O)j_jTFvwe2@(Nq2!)`#4PegxY+V3#*fkb3>zFf(ax?9`bQv*>O zLH79@FWVMl&1)5d%17F~53UyqCNIDc)(D_wqUI2F!xA#C`6mI zg6M*zgolSrydMnZ9%@0~Dam2>ijD*I`s8FDS*K^mYcg87Z_A$1t3J~UL&cDl(5Cq; z-D(#a!j~;8O1E)2Q)01w>Y$Ie+)I_a2qs*G*ueP9A=hM%>VL?i{2HO1zfqhUgaNqL z#W)Vhr&D5VwS@HJbn!h_Dqhd#z%e0juoI4Bd-!ITptC<+D{(9W-Jm=2KH?G0p4pZZ zC_3ksf;QR++3=IB`*QO6Zms)IdFvcYCVQ09=@-_D z4(b#jET_YmQ~FP_%h(4$$p8Goai^Gf#nqDeS*LDRnj=L)t2u`-JuhU}wqmLqP?^h9 zLFj%3Om^YNeHeFACE4(r|>% zfxHrn0zrg`weVn$jVeCfRQ!2vTY7ovOq29nMnGJ|H!}7oS!m-($777Wu z&vrsLvb2}Kls#O-yx0$XGUp0>sQi=A0!@nq>Ex4$ED^!qg>=<_)Fs{u2kzY=#&`5x zm)v1E;ktB%%r?`%nL7KAP15ouz*>oI1}6kO{+|8PwQ5^7Ce|`!J&E7p1YRcmxmDF5 zDI#j|nu5oRZ>qChBd_~f|4g5s3=YVL6LH`js>7ERX6O$ny(1*1W31K=Ler4BM(GQz zf3~BSu9s7@{MBoU%)0rdfqJn(QJ;0meKQb2(}5LormzG<0fPrPa82Fa7u8U!fPs{# on4y3kFM~Ps`rKywE($+oSx6s!Qg@RKM1es|J1u?K9=6X-U%+55dH?_b literal 1087 zcmV-F1iOhmgJa@N9lifOMTE&K7_Gu2$d)MqiP5c|UMYdd+ z%*%w8Y=9wP^cSqr2OoK+bl{4@8|(PCi%`?`CN{Zw2>@7;p`LS?znmV-^qGA^+XO9q#&IS3DMnX)Hl*RnE$k` z+(kGtq1?6eMDdSPwDz>T_Z1r4e)Y=>W2}7i%)_3?JnmzmfP_kEfv%t9=z3>#ka+fD zBarE?ynA4;D6%-$1D5J2-A@oxvzpq!@H@z{qg!lD`?^_hKXpMf_&vB7f~~UC@h2g^uls6ap|RYwuGp!;F0>u zhePxJGIBL6zPYnGj@XdrqvRZopYjWzNsR4_Hcp;Uv=c84`0eK z+(dS0huAq)cdpS%Bza70K>G1>c6IKR4=k>Sr1Z*4QtnhRFUaEKtG`Xrk{GH;tq@gA zgOp1v5JW9($>aE24sg~l3sUbg%4i7CzLOUZA=SYrt#Ry=%Q^V!veLNBX51oI&xEUK zNz?-#cq5FHkHXb^%}k04?R{ty$8;|+CRi1pV>KPGb=`7N6BN({LwzPg!eaoJbIPKR96>k-y} ziMDF1E~Dm{R!(4&|3;w67=0#j!nYR zrRDpwWCm=LovVY*enuWsSaI&gm#r>-3{aKyj9|e~#!t?%9C0;0<{_Lmym%(us&Tv|L-k4or(Wrxn}m zGyurEF~)=r>EgYIl0-J7NtVHFYm66}U?i9N**4!q`e3AtkSH-GcQ9UDO0>k1=jBlI zcsu8H|xFNk%6Q_7<=3zh-I*OCIiF^1*G?*kSXWdzpQf`K#RAk=tEQFE^<{@dj8 z8`%(l$LdIX`7E4UYDIw;tFYo(fOq(!=}$)y=p1!r?KVE;_StyNF%B!b`rFjjPes@tn|WoGDm?#is?kdEH#Yh95Hl6wBPa zXEKehV35OR)@sLY!2}Ye>;S#jMpu6%H#r%kQJgA*Iz!B9;%4!1#2tK34X5mEnDYgq zm9}^oGFqGoM7awyiy+%Uv|Qi?aRqApKBd$iT??u^l$fO4tpHTgs*znIzQG zY%eKjj`sPY%*_~CPPYKn&TGR2Vn3Mo6!_jG0{N8%#cC8)7vrPfH`p}hscAZ}u5Oyn zx?^f~DK9qiX;qJfLtAfS*M=ZcwlGxo z-al#bNoz2kCxMyY!%+cqYxG1&5c^j)-)I}YI7Uvz!GI65 zeIj6hU59Y^D1>7lP&?tbCtS($R42P+?fEzMz2u4+psWCuE5SH{YA2bwQ0Q6U%4(Qy z>*Q{gesVt^WyzrM-y;b=<^i$8ya*c`w);c*ETVt9#HyWCyQ~2w2rtxB!q+6Dflm&> zkHXU7h*L0$t&n!eB!{-Eqo^FskC7kh)J+Rwxp**{@Web3bH`UbvF|u9h^0>y)=~_6 zVS}Dph4BO22yC+-P4E@)gR=p|$sQ!+j}TNZoCzItWZHqhgVyGS&gpNd;SGvAXH0cw z_V7VAb;>99tow9!SprKF$;k%dJ8!HA;9Df*Qa|zqRd<*laLEB6sC+a|gsY}d;rbSh z><|Cad~iO~#^ZC6H0)S4f%0XZL&7q2>Kbb5mDK4*R(EQwQ<%vyh|!ECVpy!YIT8?) zyPwUDuuzB%V0$C(K!*+-$BOTz|{#N8p<=tj`T+w$|undjjK4g<-=;^;YK zJ`(ZEV3Qm`9JzH$4cHqZjOC6U1I7*IVxZ1tp8@hVl+Sc5_=oa#Jz^bod*ly#lB5 Y0=gKAt%DjjBNEwzf~ISO+1aWl)uEcAr~m)} literal 0 HcmV?d00001