43 lines
1.2 KiB
Nix
43 lines
1.2 KiB
Nix
{ config, ... }:
|
|
|
|
{
|
|
# These endpoints use the already-issued domain2 wildcard certificate from
|
|
# acme.nix. They stay behind Traefik; Dex, Headscale and LLDAP bind to
|
|
# loopback. LLDAP is reachable through both the public and Tailnet entrypoint
|
|
# because its web board is needed for account administration from either
|
|
# network.
|
|
services.traefik.dynamicConfigOptions.http = {
|
|
routers = {
|
|
dex-pinix = {
|
|
rule = "Host(`dex.${config.domain2}`)";
|
|
entryPoints = [ "websecure" ];
|
|
service = "dex-pinix";
|
|
tls = { };
|
|
};
|
|
headscale-pinix = {
|
|
rule = "Host(`head.${config.domain2}`)";
|
|
entryPoints = [ "websecure" ];
|
|
service = "headscale-pinix";
|
|
tls = { };
|
|
};
|
|
lldap-pinix = {
|
|
rule = "Host(`lldap.${config.domain2}`)";
|
|
entryPoints = [ "websecure" "web-internal" ];
|
|
service = "lldap-pinix";
|
|
tls = { };
|
|
};
|
|
};
|
|
|
|
services = {
|
|
dex-pinix.loadBalancer.servers = [
|
|
{ url = "http://127.0.0.1:5556"; }
|
|
];
|
|
headscale-pinix.loadBalancer.servers = [
|
|
{ url = "http://127.0.0.1:3001"; }
|
|
];
|
|
lldap-pinix.loadBalancer.servers = [
|
|
{ url = "http://127.0.0.1:17170"; }
|
|
];
|
|
};
|
|
};
|
|
}
|