From 2e5297217de007beb8444092e03cca97bf06e4ef Mon Sep 17 00:00:00 2001 From: Hamish Hutchings Date: Wed, 27 Sep 2017 17:30:49 +0100 Subject: [PATCH 1/2] nixos/traefik create service --- nixos/modules/module-list.nix | 1 + .../modules/services/web-servers/traefik.nix | 113 ++++++++++++++++++ 2 files changed, 114 insertions(+) create mode 100644 nixos/modules/services/web-servers/traefik.nix diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix index e849e634fc96..56d239316aa3 100644 --- a/nixos/modules/module-list.nix +++ b/nixos/modules/module-list.nix @@ -621,6 +621,7 @@ ./services/web-servers/phpfpm/default.nix ./services/web-servers/shellinabox.nix ./services/web-servers/tomcat.nix + ./services/web-servers/traefik.nix ./services/web-servers/uwsgi.nix ./services/web-servers/varnish/default.nix ./services/web-servers/winstone.nix diff --git a/nixos/modules/services/web-servers/traefik.nix b/nixos/modules/services/web-servers/traefik.nix new file mode 100644 index 000000000000..560f0b2a6f15 --- /dev/null +++ b/nixos/modules/services/web-servers/traefik.nix @@ -0,0 +1,113 @@ +{ config, lib, pkgs, ... }: + +with lib; + +let + cfg = config.services.traefik; +configFile = + if (cfg.configFile == null) then + (pkgs.runCommand "config.toml" { + buildInputs = [ pkgs.remarshal ]; + } '' + remarshal -if json -of toml \ + < ${pkgs.writeText "config.json" (builtins.toJSON cfg.configOptions)} \ + > $out + '') + else + cfg.configFile; + +in { + options.services.traefik = { + enable = mkEnableOption "Traefik web server"; + + configFile = mkOption { + default = null; + example = /path/to/config.toml; + type = types.nullOr types.path; + description = "Verbatim traefik.toml to use"; + }; + configOptions = mkOption { + description = '' + Config for Traefik. + ''; + type = types.attrs; + example = { + defaultEntrypoints = [ "http" ]; + web = { + address = ":8080"; + }; + entryPoints = { + http = { + address = ":80"; + }; + }; + file = {}; + frontends = { + frontend1 = { + backend = "backend1"; + routes.test_1 = { + rule = "Host:localhost"; + }; + }; + }; + backends = { + backend1 = { + servers.server1 = { + url = "http://localhost:8000"; + }; + }; + }; + }; + }; + + dataDir = mkOption { + default = "/var/lib/traefik"; + type = types.path; + description = '' + Location for any persistent data traefik creates, ie. acme + ''; + }; + + package = mkOption { + default = pkgs.traefik; + defaultText = "pkgs.traefik"; + type = types.package; + description = "Traefik package to use."; + }; + }; + + config = mkIf cfg.enable { + systemd.services.traefik = { + description = "Traefik web server"; + after = [ "network-online.target" ]; + wantedBy = [ "multi-user.target" ]; + serviceConfig = { + ExecStart = ''${cfg.package.bin}/bin/traefik --configfile=${configFile}''; + Type = "simple"; + User = "traefik"; + Group = "traefik"; + Restart = "on-failure"; + StartLimitInterval = 86400; + StartLimitBurst = 5; + AmbientCapabilities = "cap_net_bind_service"; + CapabilityBoundingSet = "cap_net_bind_service"; + NoNewPrivileges = true; + LimitNPROC = 64; + LimitNOFILE = 1048576; + PrivateTmp = true; + PrivateDevices = true; + ProtectHome = true; + ProtectSystem = "full"; + ReadWriteDirectories = cfg.dataDir; + }; + }; + + users.extraUsers.traefik = { + group = "traefik"; + home = cfg.dataDir; + createHome = true; + }; + + users.extraGroups.traefik = {}; + }; +} From 3468c9e5cce9c5fb27b96937b610dc3e02667d6f Mon Sep 17 00:00:00 2001 From: Joerg Thalheim Date: Wed, 4 Oct 2017 11:47:34 +0100 Subject: [PATCH 2/2] nixos/traefik: create /var/lib/traefik with correct permissions --- .../modules/services/web-servers/traefik.nix | 59 ++++++++++--------- 1 file changed, 30 insertions(+), 29 deletions(-) diff --git a/nixos/modules/services/web-servers/traefik.nix b/nixos/modules/services/web-servers/traefik.nix index 560f0b2a6f15..53f5a3c3c2be 100644 --- a/nixos/modules/services/web-servers/traefik.nix +++ b/nixos/modules/services/web-servers/traefik.nix @@ -4,17 +4,16 @@ with lib; let cfg = config.services.traefik; -configFile = - if (cfg.configFile == null) then - (pkgs.runCommand "config.toml" { - buildInputs = [ pkgs.remarshal ]; - } '' - remarshal -if json -of toml \ - < ${pkgs.writeText "config.json" (builtins.toJSON cfg.configOptions)} \ - > $out - '') - else - cfg.configFile; + configFile = + if cfg.configFile == null then + pkgs.runCommand "config.toml" { + buildInputs = [ pkgs.remarshal ]; + } '' + remarshal -if json -of toml \ + < ${pkgs.writeText "config.json" (builtins.toJSON cfg.configOptions)} \ + > $out + '' + else cfg.configFile; in { options.services.traefik = { @@ -24,38 +23,35 @@ in { default = null; example = /path/to/config.toml; type = types.nullOr types.path; - description = "Verbatim traefik.toml to use"; + description = '' + Path to verbatim traefik.toml to use. + (Using that option has precedence over configOptions) + ''; }; + configOptions = mkOption { description = '' Config for Traefik. ''; type = types.attrs; + default = { + defaultEntryPoints = ["http"]; + entryPoints.http.address = ":80"; + }; example = { defaultEntrypoints = [ "http" ]; - web = { - address = ":8080"; - }; - entryPoints = { - http = { - address = ":80"; - }; - }; + web.address = ":8080"; + entryPoints.http.address = ":80"; + file = {}; frontends = { frontend1 = { backend = "backend1"; - routes.test_1 = { - rule = "Host:localhost"; - }; + routes.test_1.rule = "Host:localhost"; }; }; - backends = { - backend1 = { - servers.server1 = { - url = "http://localhost:8000"; - }; - }; + backends.backend1 = { + servers.server1.url = "http://localhost:8000"; }; }; }; @@ -82,7 +78,12 @@ in { after = [ "network-online.target" ]; wantedBy = [ "multi-user.target" ]; serviceConfig = { + PermissionsStartOnly = true; ExecStart = ''${cfg.package.bin}/bin/traefik --configfile=${configFile}''; + ExecStartPre = [ + ''${pkgs.coreutils}/bin/mkdir -p "${cfg.dataDir}"'' + ''${pkgs.coreutils}/bin/install -d -m700 --owner traefik --group traefik "${cfg.dataDir}"'' + ]; Type = "simple"; User = "traefik"; Group = "traefik";