nix-config/modules/nix/containers/nixos/traefik.nix

{ lib, config, ... }:
let
  inherit (lib) mkIf mkOption types;
  cfg = config.smayzy.containers.nixos.traefik;
  net = config.smayzy.containers.networking;
in
{
  options.smayzy.containers.nixos.traefik = {
    enable = mkOption {
      type = types.bool;
      default = false;
      description = "traefik nixos ct";
    };
    ip = mkOption {
      type = types.str;
      description = "ip addr e.g. (192.168.1.20)";
    };
  };
  
  config = mkIf cfg.enable {
    age.secrets = {
      traefik-cf-tk = {
        file = ../../../../secrets/traefik-cf-tk.age;
        owner = "root";
        group = "root";
        mode = "0400";
      };
      traefik-dashboard-auth = {
        file = ../../../../secrets/traefik-dashboard-auth.age;
        mode = "0444";
      };
    };
    
    containers.traefik = {
      bindMounts = {
        "/run/secrets/traefik-cf-tk" = {
          hostPath = config.age.secrets.traefik-cf-tk.path;
          isReadOnly = true;
        };
        "/run/secrets/traefik-dashboard-auth" = {
          hostPath = config.age.secrets.traefik-dashboard-auth.path;
          isReadOnly = true;
        };
      };

      autoStart = true;
      privateNetwork = true;
      hostBridge = net.bridge;
      localAddress = cfg.ip;
      config = { ... }: {
        system.stateVersion = "25.11";

        networking.defaultGateway = net.gateway;
        networking.nameservers = net.dns;
        networking.firewall.allowedTCPPorts = [ 80 443 880 4443 ];

        systemd.services.traefik.serviceConfig.EnvironmentFile = [
          "/run/secrets/traefik-cf-tk"
        ];

        services.traefik = {
          enable = true;
          staticConfigOptions = {
            global = {
              checkNewVersion = false;
              sendAnonymousUsage = false;
            };
            log = {
              level = "WARN";
            };
            api = {
              dashboard = true;
              disabledashboardad = true;
            };
            entryPoints = {
              local = {
                address = ":80";
              };
              localSec = {
                address = ":443";
              };
              ext = {
                address = ":880";
              };
              extSec = {
                address = ":4443";
              };
            };
            certificatesResolvers = {
              cloudflare = {
                acme = {
                  email = "smayzy@smayzy.ovh";
                  storage = "/var/lib/traefik/acme.json";
                  dnsChallenge = {
                    provider = "cloudflare";
                    resolvers = [ "192.168.1.202" ];
                    propagation.delayBeforeChecks = 15;
                  };
                };
              };
            };

          };
          dynamicConfigOptions = {
            http = {
              routers = {
                traefik = {
                  rule = "Host(`traefik.internal.smayzy.ovh`) && (PathPrefix(`/api`) || PathPrefix(`/dashboard`))";
                  entryPoints = [ "localSec" ];
                  service = "api@internal";
                  tls.certResolver = "cloudflare";
                  middlewares = [ "dashboard-auth" ];
                };
                httpd = {
                  rule = "Host(`httpd.internal.smayzy.ovh`)";
                  entryPoints = [ "localSec" ];
                  service = "httpd";
                  tls.certResolver = "cloudflare";
                };
                bazarr-anime = {
                  rule = "Host(`bazarr-anime.internal.smayzy.ovh`)";
                  entryPoints = [ "localSec" ];
                  service = "bazarr-anime";
                  tls.certResolver = "cloudflare";
                };
                bazarr = {
                  rule = "Host(`bazarr.internal.smayzy.ovh`)";
                  entryPoints = [ "localSec" ];
                  service = "bazarr";
                  tls.certResolver = "cloudflare";
                };
                lidarr = {
                  rule = "Host(`lidarr.internal.smayzy.ovh`)";
                  entryPoints = [ "localSec" ];
                  service = "lidarr";
                  tls.certResolver = "cloudflare";
                };
                nzbget = {
                  rule = "Host(`nzbget.internal.smayzy.ovh`)";
                  entryPoints = [ "localSec" ];
                  service = "nzbget";
                  tls.certResolver = "cloudflare";
                };
                prowlarr = {
                  rule = "Host(`prowlarr.internal.smayzy.ovh`)";
                  entryPoints = [ "localSec" ];
                  service = "prowlarr";
                  tls.certResolver = "cloudflare";
                };
                qbittorrent = {
                  rule = "Host(`qbittorrent.internal.smayzy.ovh`)";
                  entryPoints = [ "localSec" ];
                  service = "qbittorrent";
                  tls.certResolver = "cloudflare";
                };
                radarr = {
                  rule = "Host(`radarr.internal.smayzy.ovh`)";
                  entryPoints = [ "localSec" ];
                  service = "radarr";
                  tls.certResolver = "cloudflare";
                };
                sonarr-anime = {
                  rule = "Host(`sonarr-anime.internal.smayzy.ovh`)";
                  entryPoints = [ "localSec" ];
                  service = "sonarr-anime";
                  tls.certResolver = "cloudflare";
                };
                sonarr = {
                  rule = "Host(`sonarr.internal.smayzy.ovh`)";
                  entryPoints = [ "localSec" ];
                  service = "sonarr";
                  tls.certResolver = "cloudflare";
                };
                srv1-proxmox = {
                  rule = "Host(`srv1-proxmox.internal.smayzy.ovh`)";
                  entryPoints = [ "localSec" ];
                  service = "srv1-proxmox";
                  tls.certResolver = "cloudflare";
                };
                srv2-proxmox = {
                  rule = "Host(`srv2-proxmox.internal.smayzy.ovh`)";
                  entryPoints = [ "localSec" ];
                  service = "srv2-proxmox";
                  tls.certResolver = "cloudflare";
                };
              };
              services = {
                "httpd".loadBalancer = {
                  servers = [ { url = "http://192.168.1.201"      ; } ];
                };
                "bazarr-anime".loadBalancer = {
                  servers = [ { url = "http://192.168.1.147:6768" ; } ];
                };
                "bazarr".loadBalancer = {
                  servers = [ { url = "http://192.168.1.147:6767" ; } ];
                };
                "lidarr".loadBalancer = {
                  servers = [ { url = "http://192.168.1.147:8686" ; } ];
                };
                "nzbget".loadBalancer = {
                  servers = [ { url = "http://192.168.1.147:6789" ; } ];
                };
                "prowlarr".loadBalancer = {
                  servers = [ { url = "http://192.168.1.147:9696" ; } ];
                };
                "qbittorrent".loadBalancer = {
                  servers = [ { url = "http://192.168.1.147:8080" ; } ];
                };
                "radarr".loadBalancer = {
                  servers = [ { url = "http://192.168.1.147:7878" ; } ];
                };
                "sonarr-anime".loadBalancer = {
                  servers = [ { url = "http://192.168.1.147:8988" ; } ];
                };
                "sonarr".loadBalancer = {
                  servers = [ { url = "http://192.168.1.147:8989" ; } ];
                };
                "srv1-proxmox".loadBalancer = {
                  servers = [ { url = "https://192.168.1.193:8006"; } ];
                  serversTransport = "srv1-proxmox";
                };
                "srv2-proxmox".loadBalancer = {
                  servers = [ { url = "https://192.168.1.113:8006"; } ];
                  serversTransport = "srv2-proxmox";
                };
              };
              serversTransports = {
                srv1-proxmox = {
                  serverName = "srv1-proxmox.internal.smayzy.ovh";
                };
                srv2-proxmox = {
                  serverName = "srv2-proxmox.internal.smayzy.ovh";
                };
              };
              middlewares ={
                dashboard-auth = {
                  basicAuth = {
                    usersFile = "/run/secrets/traefik-dashboard-auth";
                  };
                };
              };
            }; # http
          }; # dyna config
        }; # services.traefik
      }; # config
    }; # ct traefik
  }; # config
}