nix-config/modules/nixos/services/traefik/default.nix

{
  config,
  lib,
  namespace,
  ...
}:
with lib;
let
  cfg = config.${namespace}.services.traefik;

  # Process reverseProxies into service and router configurations
  reverseProxyServiceConfigs =
    let
      makeService = reverseProxy: nameValuePair reverseProxy.service.name reverseProxy.service.config;
    in
    listToAttrs (map makeService cfg.reverseProxies);

  reverseProxyRouterConfigs =
    let
      makeRouter = reverseProxy: nameValuePair reverseProxy.router.subdomain reverseProxy.router.config;
    in
    listToAttrs (map makeRouter cfg.reverseProxies);

  domain = "mjallen.dev";

  # Forward services
  authUrl = "http://localhost:9000/outpost.goauthentik.io";
  cacheUrl = "http://localhost:9012";
  hassUrl = "http://nuc-nixos.local:8123";

  # Plugins
  traefikPlugins = {
    bouncer = {
      moduleName = "github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin";
      version = "v1.4.5";
    };
    geoblock = {
      moduleName = "github.com/PascalMinder/geoblock";
      version = "v0.2.5";
    };
  };

  # Ports
  httpPort = 80;
  httpsPort = 443;
  traefikPort = 8080;
  metricsPort = 8082;

  forwardPorts = [
    httpPort
    httpsPort
    traefikPort
    metricsPort
  ];

  # misc
  letsEncryptEmail = "jalle008@proton.me";
  configDir = "/media/nas/main/appdata";
in
{
  imports = [
    ./options.nix
    ./sops.nix
  ];

  config = mkIf cfg.enable {

    networking.firewall = {
      allowedTCPPorts = forwardPorts;
      allowedUDPPorts = forwardPorts;
    };

    # services.traefik = {
    #   enable = true;
    #   dataDir = "${configDir}/traefik";
    #   group = "jallen-nas"; # group;
    #   environmentFiles = [ config.sops.templates."traefik.env".path ];

    #   static = {
    #     # dir = "${configDir}/traefik";
    #     settings = {
    #       entryPoints = {
    #         web = {
    #           address = ":${toString httpPort}";
    #           asDefault = true;
    #           http.redirections.entrypoint = {
    #             to = "websecure";
    #             scheme = "https";
    #           };
    #         };

    #         websecure = {
    #           address = ":${toString httpsPort}";
    #           asDefault = true;
    #           http.tls.certResolver = "letsencrypt";
    #         };

    #         metrics = {
    #           address = ":${toString metricsPort}"; # Port for metrics
    #         };
    #       };

    #       log = {
    #         level = "INFO";
    #       };

    #       metrics = {
    #         prometheus = {
    #           entryPoint = "metrics";
    #           addEntryPointsLabels = true;
    #           addServicesLabels = true;
    #           buckets = [
    #             0.1
    #             0.3
    #             1.2
    #             5.0
    #           ]; # Response time buckets
    #         };
    #       };

    #       certificatesResolvers.letsencrypt.acme = {
    #         email = letsEncryptEmail;
    #         storage = "${config.services.traefik.dataDir}/acme.json";
    #         dnsChallenge = {
    #           provider = "cloudflare";
    #           resolvers = [
    #             "1.1.1.1:53"
    #             "8.8.8.8:53"
    #           ];
    #         };
    #       };

    #       # Access the Traefik dashboard on <Traefik IP>:8080
    #       api = {
    #         dashboard = true;
    #         insecure = true;
    #       };

    #       experimental = {
    #         plugins = traefikPlugins;
    #       };
    #     };
    #   };

    #   dynamic = {
    #     dir = "/run/traefik";
    #     files = {
    #       "serversTransports".settings.http = {
    #         serversTransports = {
    #           internal-https = {
    #             insecureSkipVerify = true;
    #           };
    #           http1 = {
    #             serverName = "localhost";
    #             disableHTTP2 = true;
    #           };
    #         };
    #       };

    #       "middlewares-authentik".settings.http = {
    #         middlewares = {
    #           authentik = {
    #             forwardAuth = {
    #               tls.insecureSkipVerify = true;
    #               address = "${authUrl}/auth/traefik";
    #               trustForwardHeader = true;
    #               authResponseHeaders = [
    #                 "X-authentik-username"
    #                 "X-authentik-groups"
    #                 "X-authentik-email"
    #                 "X-authentik-name"
    #                 "X-authentik-uid"
    #                 "X-authentik-jwt"
    #                 "X-authentik-meta-jwks"
    #                 "X-authentik-meta-outpost"
    #                 "X-authentik-meta-provider"
    #                 "X-authentik-meta-app"
    #                 "X-authentik-meta-version"
    #               ];
    #             };
    #           };
    #         };
    #       };

    #       "middlewares-crowdsec".settings.http = {
    #         middlewares = {
    #           crowdsec = {
    #             plugin = {
    #               bouncer = {
    #                 enabled = true;
    #                 crowdsecLapiKeyFile = config.sops.secrets."jallen-nas/traefik/crowdsec/lapi-key".path;
    #                 crowdsecLapiScheme = "http";
    #                 crowdsecLapiHost = "localhost:8181";
    #                 crowdsecLapiPath = "/";
    #                 crowdsecLapiTLSInsecureVerify = false;
    #                 crowdsecCapiMachineIdFile = config.sops.secrets."jallen-nas/traefik/crowdsec/capi-machine-id".path;
    #                 crowdsecCapiPasswordFile = config.sops.secrets."jallen-nas/traefik/crowdsec/capi-password".path;
    #                 crowdsecCapiScenarios = [ ];
    #               };
    #             };
    #           };
    #         };
    #       };

    #       "middlewares-geoblock".settings.http = {
    #         middlewares = {
    #           whitelist-geoblock = {
    #             plugin = {
    #               geoblock = {
    #                 silentStartUp = false;
    #                 allowLocalRequests = true;
    #                 logLocalRequests = false;
    #                 logAllowedRequests = false;
    #                 logApiRequests = false;
    #                 api = "https://get.geojs.io/v1/ip/country/{ip}";
    #                 apiTimeoutMs = 500;
    #                 cacheSize = 25;
    #                 forceMonthlyUpdate = true;
    #                 allowUnknownCountries = false;
    #                 unknownCountryApiResponse = "nil";
    #                 blackListMode = false;
    #                 countries = [
    #                   "CA"
    #                   "US"
    #                 ];
    #               };
    #             };
    #           };
    #         };
    #       };

    #       "middlewares-ipallowlist".settings.http = {
    #         middlewares = {
    #           internal-ipallowlist = {
    #             ipAllowList = {
    #               sourceRange = [
    #                 "127.0.0.1/32"
    #                 "10.0.1.0/24"
    #               ];
    #             };
    #           };
    #         };
    #       };

    #       "services-auth".settings.http = {
    #         services = {
    #           auth.loadBalancer.servers = [
    #             {
    #               url = authUrl;
    #             }
    #           ];
    #         };
    #       };

    #       "services-cache".settings.http = {
    #         services = {
    #           cache.loadBalancer = {
    #             servers = [
    #               {
    #                 url = cacheUrl;
    #               }
    #             ];
    #             serversTransport = "http1";
    #           };
    #         };
    #       };

    #       "services-nginx".settings.http = {
    #         services = {
    #           nginx.loadBalancer.servers = [
    #             {
    #               url = "http://localhost:8188";
    #             }
    #           ];
    #         };
    #       };

    #       "services-generated".settings.http = reverseProxyServiceConfigs;

    #       "routers-auth".settings.http = {
    #         routers = {
    #           auth = {
    #             entryPoints = [ "websecure" ];
    #             rule = "HostRegexp(`{subdomain:[a-z]+}.mjallen.dev`) && PathPrefix(`/outpost.goauthentik.io/`)";
    #             service = "auth";
    #             middlewares = [
    #               "crowdsec"
    #               "whitelist-geoblock"
    #             ];
    #             priority = 15;
    #             tls.certResolver = "letsencrypt";
    #           };
    #         };
    #       };

    #       "routers-matrix2".settings.http = {
    #         routers = {
    #           matrix2 = {
    #             entryPoints = [ "websecure" ];
    #             rule = "Host(`matrix.mjallen.dev`) && PathPrefix(`/.well-known/matrix/`)";
    #             service = "nginx";
    #             middlewares = [
    #               "crowdsec"
    #               "whitelist-geoblock"
    #             ];
    #             priority = 1;
    #             tls.certResolver = "letsencrypt";
    #           };
    #         };
    #       };

    #       "routers-matrix3".settings.http = {
    #         routers = {
    #           matrix3 = {
    #             entryPoints = [ "websecure" ];
    #             rule = "Host(`mjallen.dev`) && PathPrefix(`/.well-known/matrix/`)";
    #             service = "nginx";
    #             middlewares = [
    #               "crowdsec"
    #               "whitelist-geoblock"
    #             ];
    #             priority = 1;
    #             tls.certResolver = "letsencrypt";
    #           };
    #         };
    #       };

    #       "routers-cache".settings.http = {
    #         routers = {
    #           cache = {
    #             entryPoints = [ "websecure" ];
    #             rule = "Host(`cache.${domain}`)";
    #             service = "cache";
    #             middlewares = [ ];
    #             priority = 10;
    #             tls.certResolver = "letsencrypt";
    #           };
    #         };
    #       };

    #       "home-assistant".settings.http = {
    #         services = {
    #           hass.loadBalancer.servers = [
    #             {
    #               url = hassUrl;
    #             }
    #           ];
    #         };
    #         routers = {
    #           hass = {
    #             entryPoints = [ "websecure" ];
    #             rule = "Host(`hass.${domain}`)";
    #             service = "hass";
    #             middlewares = [
    #               "crowdsec"
    #               "whitelist-geoblock"
    #               # "authentik"
    #             ];
    #             priority = 10;
    #             tls.certResolver = "letsencrypt";
    #           };
    #         };
    #       };
    #       "routers-generated".settings.http = reverseProxyRouterConfigs;
    #     };
    #   };
    # };
  };
}