Restructured, Configured Traefik for Mailcow

modules/nixos/services/forgejo-runner/default.nix

@@ -1,87 +0,0 @@
-{ inputs, config, lib, pkgs, ... }:
-let
-  cfg = config.services.forgejo-runner;
-in
-{
-  options.services.forgejo-runner = {
-    enable = lib.mkOption {
-      type = with lib.types; uniq bool;
-      default = false;
-      description = "Enable Forgejo Runners";
-    };
-  };
-  config = lib.mkIf (cfg.enable) {
-    # services.gitea-actions-runner.package = pkgs.forgejo-runner;
-    # services.gitea-actions-runner.instances."kb-one-runner@games-01" = {
-    #   enable = true;
-    #   name = "kb-one-runner@games-01";
-    #   url = "https://git.kb-one.de/";
-    #   tokenFile = "/opt/secrets/kb-one-runner@games-01_token";
-    #   labels = [
-    #     # provide a debian base with nodejs for actions
-    #     "debian-latest:docker://node:18-bullseye"
-    #     # fake the ubuntu name, because node provides no ubuntu builds
-    #     "ubuntu-latest:docker://node:18-bullseye"
-    #     # provide native execution on the host
-    #     "native:host"
-    #   ];
-    #   hostPackages = with pkgs; [
-    #     bash
-    #     coreutils
-    #     curl
-    #     gawk
-    #     gitMinimal
-    #     gnused
-    #     nodejs
-    #     wget
-    #     nix
-    #   ];
-    # };
-
-    # systemd.services.forgejo-runner = {
-    #   wantedBy = [ "multi-user.target" ];
-    #   after = [ "docker.service" ];
-    #   description = "";
-    #   serviceConfig = {
-    #     Type = "notify";
-    #     User = "runner";
-    #     WorkingDirectory = "/home/runner";
-    #     ExecStart = ''${pkgs.forgejo-runner}/bin/forgejo-runner deamon''; 
-    #     ExecStop = ''/bin/kill -s HUP $MAINPID'';
-    #     Restart = "on-failure";
-    #     TimeoutSec = 0;
-    #     RestartSec = 10;
-    #   };
-    # };
-
-    # users.users.runner = {
-    #   isNormalUser = true;
-    # };
-
-    # environment.systemPackages = [ pkgs.forgejo-runner ];
-
-    # virtualisation.podman.enable = true;
-    # virtualisation.podman.defaultNetwork.settings.dns_enabled = true;
-    # virtualisation.podman.dockerCompat = true;
-
-    virtualisation.docker.enable = true;
-    virtualisation.oci-containers.backend = "docker";
-
-    virtualisation.oci-containers.containers."docker-in-docker" = {
-      image = "docker:dind";
-      hostname = "docker";
-      extraOptions = [ "--privileged" "--network=kb-forgejo-runner" ];
-      cmd = [ "dockerd" "-H" "tcp://docker:42349" "--tls=false" ];
-    };
-    virtualisation.oci-containers.containers."forgejo-runner" = {
-      image = "code.forgejo.org/forgejo/runner:4.0.0";
-      hostname = "forgejo-runner";
-      extraOptions = [ "--network=kb-forgejo-runner" ];
-      environment.DOCKER_HOST = "tcp://docker:42349";
-      user = "1001:1001";
-      volumes = [ "forgejo-runner-data:/data" ];
-      cmd = [ "/bin/sh" "-c" "sleep 5; forgejo-runner daemon" ];
-    };
-  };
-}
-

systems/x86_64-linux/pkpnafs/default.nix

@@ -3,6 +3,8 @@
 {
   imports = [ # Include the results of the hardware scan.
     ./hardware.nix
+    ./forgejo.nix
+    ./traefik.nix
   ];
 
   # Configure Nix
@@ -74,6 +76,9 @@
   sops.defaultSopsFormat = "yaml";
   sops.age.keyFile = "/home/master/.config/sops/age/keys.txt";
 
+  # Firewall
+  networking.firewall.allowedTCPPorts = [ 80 443 25 465 587 143 993 110 995 4190 ];
+
   # SSH and Mosh
   services.openssh = {
     enable = true;
@@ -86,16 +91,13 @@
 
   # Minecraft Servers
   services.minecraft = {
-    enable = true;
+    enable = false;
     servers.velocity.enable = true;
     servers.survival.enable = true;
   };
 
-  # Forgejo Runner
-  services.forgejo-runner.enable = true;
-
-  # Binary Cache 
-  services.binary-cache.enable = false; # No Binary-Cache, when there are Secrets in the /nix/store
+  # Docker
+  virtualisation.docker.enable = true;
 
   # Do NOT change this value 
   system.stateVersion = "24.05"; # Did you read the comment?

systems/x86_64-linux/pkpnafs/forgejo.nix

@@ -0,0 +1,21 @@
+{ config, lib, pkgs, inputs, ... }:
+{
+  virtualisation.oci-containers.backend = "docker";
+  virtualisation.oci-containers.containers."docker-in-docker" = {
+    image = "docker:dind";
+    hostname = "docker";
+    extraOptions = [ "--privileged" "--network=kb-forgejo-runner" ];
+    cmd = [ "dockerd" "-H" "tcp://docker:42349" "--tls=false" ];
+  };
+  virtualisation.oci-containers.containers."forgejo-runner" = {
+    image = "code.forgejo.org/forgejo/runner:4.0.0";
+    hostname = "forgejo-runner";
+    extraOptions = [ "--network=kb-forgejo-runner" ];
+    environment.DOCKER_HOST = "tcp://docker:42349";
+    user = "1001:1001";
+    volumes = [ "forgejo-runner-data:/data" ];
+    cmd = [ "/bin/sh" "-c" "sleep 5; forgejo-runner daemon" ];
+  };
+}
+
+

systems/x86_64-linux/pkpnafs/traefik.nix

@@ -0,0 +1,41 @@
+{ config, lib, pkgs, inputs, ... }:
+{
+  services.traefik = {
+    enable = true;
+    staticConfigOptions = {
+      api = {
+        dashboard = false;
+        insecure = false;
+      }; 
+      entryPoints = {
+        http = {
+          address = ":80";
+          http.redirections.entrypoint = {
+            to = "https";
+            scheme = "https";
+          };
+        };
+        https = {
+          address = ":443";
+        };
+      };
+      certificatesResolvers.letsencrypt.acme = {
+        storage = "/run/secrets/acme.json";
+        httpchallenge.entrypoint = "http";
+      };
+    }; 
+  };
+
+  services.traefik.dynamicConfigOptions = {
+    # Traefik Dashbaord
+    http.routers.dashboard.rule = "Host(`traefik.pkpnafs.kb-one.de`)";
+    http.routers.dashboard.service = "api@internal";
+    # Mailcow
+    http.services.nginx-mailcow.loadbalancer.servers = [ { url = "http://localhost:8080/"; } ];
+    http.routers.nginx-mailcow.entrypoints = "https";
+    http.routers.nginx-mailcow.tls.certresolver = "letsencrypt";
+    http.routers.nginx-mailcow.rule = "Host(`mail.kb-one.de`)";
+    http.routers.nginx-mailcow.service = "nginx-mailcow";
+  };
+
+}