feat(traefik): setup traefik with agenix for secrets.

modules/servers/general/default.nix

@@ -2,5 +2,7 @@
   imports = [
     ./openssh.nix
     ./user.nix
+    ./traefik.nix
+    ./secrets.nix
   ];
 }

modules/servers/general/secrets.nix

@@ -0,0 +1,10 @@
+{
+  age = {
+    secrets = {
+      traefik = {
+        file = ../../../secrets/traefik.age;
+        owner = "traefik";
+      };
+    };
+  };
+}

modules/servers/general/traefik.nix

@@ -0,0 +1,44 @@
+{config, ...}: {
+  services.traefik = {
+    enable = true;
+    staticConfigOptions = {
+      log = {level = "WARN";};
+      certifiedResolvers = {
+        porkbun = {
+          acme = {
+            email = "crony@cronyakatsuki.xyz";
+            storage = "/var/lib/traefik/acme.json";
+            caserver = "https://acme-v02.api.letsencrypt.org/directory";
+            dnsChallenge = {
+              provider = "porkbun";
+              resolvers = ["1.1.1.1" "8.8.8.8"];
+              propagation = {
+                delayBeforeChecks = 60;
+                disableChecks = true;
+              };
+            };
+          };
+        };
+      };
+      api = {};
+      entryPoints = {
+        web = {
+          address = ":80";
+          http.redirections.entryPoint = {
+            to = "websecure";
+            scheme = "https";
+          };
+        };
+        websecure = {
+          address = ":443";
+        };
+      };
+    };
+  };
+
+  systemd.services.traefik.serviceConfig = {
+    EnvironmentFile = ["${config.age.secrets.traefik.path}"];
+  };
+
+  networking.firewall.allowedTCPPorts = [80 443];
+}