hosts/server1/configuration.nix

@@ -24,10 +24,12 @@
       nixos = {
         httpd = {
           enable = true;
+          bridge = "br0";
           ip = "192.168.1.201/24";
         };
         unbound = {
           enable = true;
+          bridge = "br0";
           ip = "192.168.1.202/24";
         };
       };

modules/nix/containers/nixos/default.nix

@@ -2,7 +2,6 @@
 {
   imports = [
     ./httpd.nix
-    ./traefik.nix
     ./unbound.nix
   ];
 }

modules/nix/containers/nixos/httpd.nix

@@ -11,6 +11,10 @@ in
       default = false;
       description = "httpd nixos ct";
     };
+    bridge = mkOption {
+      type = types.str;
+      description = "the bridge to use e.g. (br0)";
+    };
     ip = mkOption {
       type = types.str;
       description = "ip addr e.g. (192.168.1.20)";
@@ -21,7 +25,7 @@ in
     containers.httpd = {
       autoStart = true;
       privateNetwork = true;
-      hostBridge = net.bridge;
+      hostBridge = cfg.bridge;
       localAddress = cfg.ip;
       config = { ... }: {
         system.stateVersion = "25.11";

modules/nix/containers/nixos/traefik.nix

@@ -1,94 +0,0 @@
-{ lib, config, ... }:
-let
-  inherit (lib) mkIf mkOption types;
-  cfg = config.smayzy.containers.nixos.traefik;
-  net = config.smayzy.containers.networking;
-in
-{
-  options.smayzy.containers.nixos.traefik = {
-    enable = mkOption {
-      type = types.bool;
-      default = false;
-      description = "traefik nixos ct";
-    };
-    ip = mkOption {
-      type = types.str;
-      description = "ip addr e.g. (192.168.1.20)";
-    };
-  };
-  
-  config = mkIf cfg.enable {
-    age.secrets.traefik-cf-tk = {
-      file = ../../../../secrets/traefik-cf-tk.age;
-      owner = "root";
-      group = "root";
-      mode = "0400";
-    };
-
-    
-    containers.traefik = {
-      bindMounts."/run/secrets/traefik-cf-tk" = {
-        hostPath = config.age.secrets.traefik-cf-tk.path;
-        isReadOnly = true;
-      };
-
-      autoStart = true;
-      privateNetwork = true;
-      hostBridge = net.bridge;
-      localAddress = cfg.ip;
-      config = { ... }: {
-        system.stateVersion = "25.11";
-
-        networking.defaultGateway = net.gateway;
-        networking.nameservers = net.dns;
-        networking.firewall.allowedTCPPorts = [ 8080 80 443 880 4443 ];
-
-        systemd.services.traefik.serviceConfig.EnvironmentFile = [
-          "/run/secrets/traefik-cf-tk"
-        ];
-
-        services.traefik = {
-          enable = true;
-          staticConfigOptions = {
-            log = {
-              level = "WARN";
-            };
-            api = {
-              dashboard = true;
-              insecure = true;
-            };
-            entryPoints = {
-              local = {
-                address = ":80";
-              };
-              localSec = {
-                address = ":443";
-              };
-              ext = {
-                address = ":880";
-              };
-              extSec = {
-                address = ":4443";
-              };
-            };
-            certificatesResolvers = {
-              cloudflare = {
-                acme = {
-                  email = "smayzy@smayzy.ovh";
-                  dnsChallenge = {
-                    provider = "cloudflare";
-                    resolvers = [ "192.168.1.202" ];
-                    propagation.delayBeforeChecks = 15;
-                  };
-                };
-              };
-            };
-
-          };
-          dynamicConfigOptions = {
-          };
-        };
-      };
-    };
-  };
-}

modules/nix/containers/nixos/unbound.nix

@@ -11,6 +11,10 @@ in
       default = false;
       description = "unbound nixos ct";
     };
+    bridge = mkOption {
+      type = types.str;
+      description = "the bridge to use e.g. (br0)";
+    };
     ip = mkOption {
       type = types.str;
       description = "ip addr e.g. (192.168.1.20)";
@@ -21,7 +25,7 @@ in
     containers.unbound = {
       autoStart = true;
       privateNetwork = true;
-      hostBridge = net.bridge;
+      hostBridge = cfg.bridge;
       localAddress = cfg.ip;
       config = { ... }: {
         system.stateVersion = "25.11";

secrets/secrets.nix

@@ -46,6 +46,4 @@ in
   "servers.age" = mkKey servers;
 
   "systems.age" = mkKey systems;
-
-  "traefik-cf-tk.age" = mkKey desktop1;
 }

secrets/traefik-cf-tk.age

@@ -1,10 +0,0 @@
------BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IExwTFA3dyBaZTRB
-UmhMWGEzTXVsbVg1cEI4a2NGOG01bDZINUtNWlhyemFRUUZWYjI4Cjh0b1ladXli
-dmV6d0d6V1hmTk02YU8wVHpMNFNQMW1uVlNYeEx0SE1nUjAKLT4gc3NoLWVkMjU1
-MTkgR3Q0b2R3IFZCUUdKcGY2TTRSSWhqWllkd2RsVmw1M2h4RllZU0ZSM1N6eThG
-UXVleXcKRUp0V0h2djdEMnpVVUlwUThXMENYWFhlM1I0R1FBcVNuWDRUNDFKazho
-bwotLS0gTXJCQ2dDZkJod2Ezc3Y3VThXNGhpVHlkbHZGUlJOU1Q0SDZVTGFnZ1FB
-awpkI4uVSv1v7+/Ad7Up8Uo6v7O8NRmLClI/08IzXPL0RrTvj55SO3Adct1qnknW
-GPsNHiMUgWxAfYMAKjsoz95zxPmzLJrV6Fm5penyyRC8X3ssZgH8HLoBueQ=
------END AGE ENCRYPTED FILE-----