44 lines
968 B
Nix
44 lines
968 B
Nix
{config, ...}: {
|
|
networking.firewall = {
|
|
enable = true;
|
|
allowedTCPPorts = [80 443 25565 25567];
|
|
};
|
|
networking.firewall.extraInputRules = ''
|
|
tcp dport 2053 drop
|
|
''; #fuck off
|
|
|
|
services.traefik = {
|
|
enable = true;
|
|
|
|
staticConfigOptions = {
|
|
entryPoints = {
|
|
web = {
|
|
address = ":80";
|
|
http.redirections.entrypoint = {
|
|
to = "websecure";
|
|
scheme = "https";
|
|
};
|
|
};
|
|
|
|
websecure = {
|
|
address = ":443";
|
|
http.tls.certResolver = "letsencrypt";
|
|
};
|
|
};
|
|
|
|
log = {
|
|
level = "INFO";
|
|
filePath = "${config.services.traefik.dataDir}/traefik.log";
|
|
format = "json";
|
|
};
|
|
|
|
certificatesResolvers.letsencrypt.acme = {
|
|
email = "tulg@protonmail.ch";
|
|
storage = "${config.services.traefik.dataDir}/acme.json";
|
|
httpChallenge.entryPoint = "web";
|
|
};
|
|
|
|
api.dashboard = true;
|
|
};
|
|
};
|
|
}
|