replace individual bridge option by common one

hosts/server1/configuration.nix

@@ -24,12 +24,10 @@
       nixos = {
         httpd = {
           enable = true;
-          bridge = "br0";
           ip = "192.168.1.201/24";
         };
         unbound = {
           enable = true;
-          bridge = "br0";
           ip = "192.168.1.202/24";
         };
       };

modules/nix/containers/nixos/default.nix

@@ -2,6 +2,7 @@
 {
   imports = [
     ./httpd.nix
+    ./traefik.nix
     ./unbound.nix
   ];
 }

modules/nix/containers/nixos/httpd.nix

@@ -11,10 +11,6 @@ in
       default = false;
       description = "httpd nixos ct";
     };
-    bridge = mkOption {
-      type = types.str;
-      description = "the bridge to use e.g. (br0)";
-    };
     ip = mkOption {
       type = types.str;
       description = "ip addr e.g. (192.168.1.20)";
@@ -25,7 +21,7 @@ in
     containers.httpd = {
       autoStart = true;
       privateNetwork = true;
-      hostBridge = cfg.bridge;
+      hostBridge = net.bridge;
       localAddress = cfg.ip;
       config = { ... }: {
         system.stateVersion = "25.11";

modules/nix/containers/nixos/traefik.nix

@@ -0,0 +1,94 @@
+{ lib, config, ... }:
+let
+  inherit (lib) mkIf mkOption types;
+  cfg = config.smayzy.containers.nixos.traefik;
+  net = config.smayzy.containers.networking;
+in
+{
+  options.smayzy.containers.nixos.traefik = {
+    enable = mkOption {
+      type = types.bool;
+      default = false;
+      description = "traefik nixos ct";
+    };
+    ip = mkOption {
+      type = types.str;
+      description = "ip addr e.g. (192.168.1.20)";
+    };
+  };
+  
+  config = mkIf cfg.enable {
+    age.secrets.traefik-cf-tk = {
+      file = ../../../../secrets/traefik-cf-tk.age;
+      owner = "root";
+      group = "root";
+      mode = "0400";
+    };
+
+    
+    containers.traefik = {
+      bindMounts."/run/secrets/traefik-cf-tk" = {
+        hostPath = config.age.secrets.traefik-cf-tk.path;
+        isReadOnly = true;
+      };
+
+      autoStart = true;
+      privateNetwork = true;
+      hostBridge = net.bridge;
+      localAddress = cfg.ip;
+      config = { ... }: {
+        system.stateVersion = "25.11";
+
+        networking.defaultGateway = net.gateway;
+        networking.nameservers = net.dns;
+        networking.firewall.allowedTCPPorts = [ 8080 80 443 880 4443 ];
+
+        systemd.services.traefik.serviceConfig.EnvironmentFile = [
+          "/run/secrets/traefik-cf-tk"
+        ];
+
+        services.traefik = {
+          enable = true;
+          staticConfigOptions = {
+            log = {
+              level = "WARN";
+            };
+            api = {
+              dashboard = true;
+              insecure = true;
+            };
+            entryPoints = {
+              local = {
+                address = ":80";
+              };
+              localSec = {
+                address = ":443";
+              };
+              ext = {
+                address = ":880";
+              };
+              extSec = {
+                address = ":4443";
+              };
+            };
+            certificatesResolvers = {
+              cloudflare = {
+                acme = {
+                  email = "smayzy@smayzy.ovh";
+                  dnsChallenge = {
+                    provider = "cloudflare";
+                    resolvers = [ "192.168.1.202" ];
+                    propagation.delayBeforeChecks = 15;
+                  };
+                };
+              };
+            };
+
+          };
+          dynamicConfigOptions = {
+          };
+        };
+      };
+    };
+  };
+}

modules/nix/containers/nixos/unbound.nix

@@ -11,10 +11,6 @@ in
       default = false;
       description = "unbound nixos ct";
     };
-    bridge = mkOption {
-      type = types.str;
-      description = "the bridge to use e.g. (br0)";
-    };
     ip = mkOption {
       type = types.str;
       description = "ip addr e.g. (192.168.1.20)";
@@ -25,7 +21,7 @@ in
     containers.unbound = {
       autoStart = true;
       privateNetwork = true;
-      hostBridge = cfg.bridge;
+      hostBridge = net.bridge;
       localAddress = cfg.ip;
       config = { ... }: {
         system.stateVersion = "25.11";

secrets/secrets.nix

@@ -46,4 +46,6 @@ in
   "servers.age" = mkKey servers;
 
   "systems.age" = mkKey systems;
+
+  "traefik-cf-tk.age" = mkKey desktop1;
 }

secrets/traefik-cf-tk.age

@@ -0,0 +1,10 @@
+-----BEGIN AGE ENCRYPTED FILE-----
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IExwTFA3dyBaZTRB
+UmhMWGEzTXVsbVg1cEI4a2NGOG01bDZINUtNWlhyemFRUUZWYjI4Cjh0b1ladXli
+dmV6d0d6V1hmTk02YU8wVHpMNFNQMW1uVlNYeEx0SE1nUjAKLT4gc3NoLWVkMjU1
+MTkgR3Q0b2R3IFZCUUdKcGY2TTRSSWhqWllkd2RsVmw1M2h4RllZU0ZSM1N6eThG
+UXVleXcKRUp0V0h2djdEMnpVVUlwUThXMENYWFhlM1I0R1FBcVNuWDRUNDFKazho
+bwotLS0gTXJCQ2dDZkJod2Ezc3Y3VThXNGhpVHlkbHZGUlJOU1Q0SDZVTGFnZ1FB
+awpkI4uVSv1v7+/Ad7Up8Uo6v7O8NRmLClI/08IzXPL0RrTvj55SO3Adct1qnknW
+GPsNHiMUgWxAfYMAKjsoz95zxPmzLJrV6Fm5penyyRC8X3ssZgH8HLoBueQ=
+-----END AGE ENCRYPTED FILE-----