add auth to traefik and mv it to server1

modules/nix/containers/nixos/traefik.nix

@@ -18,18 +18,29 @@ in
   };
   
   config = mkIf cfg.enable {
-    age.secrets.traefik-cf-tk = {
-      file = ../../../../secrets/traefik-cf-tk.age;
-      owner = "root";
-      group = "root";
-      mode = "0400";
+    age.secrets = {
+      traefik-cf-tk = {
+        file = ../../../../secrets/traefik-cf-tk.age;
+        owner = "root";
+        group = "root";
+        mode = "0400";
+      };
+      traefik-dashboard-auth = {
+        file = ../../../../secrets/traefik-dashboard-auth.age;
+        mode = "0444";
+      };
     };
-
     
     containers.traefik = {
-      bindMounts."/run/secrets/traefik-cf-tk" = {
-        hostPath = config.age.secrets.traefik-cf-tk.path;
-        isReadOnly = true;
+      bindMounts = {
+        "/run/secrets/traefik-cf-tk" = {
+          hostPath = config.age.secrets.traefik-cf-tk.path;
+          isReadOnly = true;
+        };
+        "/run/secrets/traefik-dashboard-auth" = {
+          hostPath = config.age.secrets.traefik-dashboard-auth.path;
+          isReadOnly = true;
+        };
       };
 
       autoStart = true;
@@ -50,11 +61,16 @@ in
         services.traefik = {
           enable = true;
           staticConfigOptions = {
+            global = {
+              checkNewVersion = false;
+              sendAnonymousUsage = false;
+            };
             log = {
               level = "WARN";
             };
             api = {
               dashboard = true;
+              disabledashboardad = true;
             };
             entryPoints = {
               local = {
@@ -89,10 +105,11 @@ in
             http = {
               routers = {
                 traefik = {
-                  rule = "Host(`traefik.internal.smayzy.ovh`)";
+                  rule = "Host(`traefik.internal.smayzy.ovh`) && (PathPrefix(`/api`) || PathPrefix(`/dashboard`))";
                   entryPoints = [ "localSec" ];
                   service = "api@internal";
                   tls.certResolver = "cloudflare";
+                  middlewares = [ "dashboard-auth" ];
                 };
                 httpd = {
                   rule = "Host(`httpd.internal.smayzy.ovh`)";
@@ -215,6 +232,13 @@ in
                   serverName = "srv2-proxmox.internal.smayzy.ovh";
                 };
               };
+              middlewares ={
+                dashboard-auth = {
+                  basicAuth = {
+                    usersFile = "/run/secrets/traefik-dashboard-auth";
+                  };
+                };
+              };
             }; # http
           }; # dyna config
         }; # services.traefik