reverse proxy stuff

modules/nixos/services/traefik/default.nix

@@ -8,6 +8,48 @@ with lib;
 let
   cfg = config.${namespace}.services.traefik;
 
+  # Process extraServices into service configurations
+  extraServiceConfigs = 
+    let
+      makeService = service: nameValuePair service.name {
+        loadBalancer.servers = [
+          {
+            url = service.url;
+          }
+        ];
+      };
+    in
+    listToAttrs (map makeService cfg.extraServices);
+
+  # Process extraRouters into router configurations
+  extraRouterConfigs = 
+    let
+      makeRouter = router: nameValuePair router.subdomain {
+        entryPoints = router.entryPoints;
+        rule = "Host(`${router.subdomain}.${domain}`)";
+        service = router.service;
+        middlewares = router.middlewares ++ [
+          "crowdsec"
+          "whitelist-geoblock"
+        ];
+        tls.certResolver = "letsencrypt";
+      };
+    in
+    listToAttrs (map makeRouter cfg.extraRouters);
+
+  # Process reverseProxies into service and router configurations
+  reverseProxyServiceConfigs = 
+    let
+      makeService = reverseProxy: nameValuePair reverseProxy.service.name reverseProxy.service.config;
+    in
+    listToAttrs (map makeService cfg.reverseProxies);
+
+  reverseProxyRouterConfigs = 
+    let
+      makeRouter = reverseProxy: nameValuePair reverseProxy.router.subdomain reverseProxy.router.config;
+    in
+    listToAttrs (map makeRouter cfg.reverseProxies);
+
   domain = "mjallen.dev";
   serverIp = "10.0.1.3";
 
@@ -318,7 +360,7 @@ in
                 url = paperlessUrl;
               }
             ];
-          };
+          } // extraServiceConfigs // reverseProxyServiceConfigs;
 
           routers = {
             auth = {
@@ -447,7 +489,7 @@ in
               ];
               tls.certResolver = "letsencrypt";
             };
-          };
+          } // extraRouterConfigs // reverseProxyRouterConfigs;
         };
       };
     };

modules/nixos/services/traefik/options.nix

@@ -1,7 +1,34 @@
 { lib, namespace, ... }:
 with lib;
+let
+  inherit (lib.${namespace}) mkOpt mkBoolOpt;
+in
 {
   options.${namespace}.services.traefik = {
     enable = mkEnableOption "enable traefik";
+
+    extraServices = mkOpt (types.listOf (types.submodule {
+          options = {
+            name = mkOpt types.str "" "Name of the service";
+            url = mkOpt types.str "http://localhost:8080" "Url of the service";
+          };
+        })) [ ] "List of extra services to forward";
+
+    extraRouters = mkOpt (types.listOf (types.submodule {
+          options = {
+            entryPoints = mkOpt (types.listOf types.str) [ "websecure" ] "Entrypoint";
+            subdomain = mkOpt types.str "" "subdomain of the service";
+            service = mkOpt types.str "" "name of the service";
+            middlewares = mkOpt (types.listOf (types.enum [
+                              "authentik"
+                              "onlyoffice-websocket"
+                              "crowdsec"
+                              "whitelist-geoblock"
+                              "internal-ipallowlist"
+                            ])) [ ] "List of middlewares to enable";
+          };
+        })) [ ] "List of extra services to forward";
+
+    reverseProxies = mkOpt (types.listOf types.attrs) [ ] "List of reverse proxy configurations from mkReverseProxy";
   };
 }