let's go

hosts/m3-zelda/services/containers/default.nix

@@ -0,0 +1,5 @@
+{
+  imports = [
+    ./slash.nix
+  ];
+}

hosts/m3-zelda/services/containers/slash.nix

@@ -0,0 +1,26 @@
+{
+  virtualisation.oci-containers.containers."slash" = {
+    image = "docker.io/yourselfhosted/slash:latest";
+    ports = ["127.0.0.1:3010:5231"];
+    volumes = [
+      "slash_data:/var/opt/slash"
+    ];
+  };
+  # Traefik configuration specific to littlelink
+  services.traefik.dynamicConfigOptions.http = {
+    services.slash.loadBalancer.servers = [
+      {
+        url = "http://localhost:3010/";
+      }
+    ];
+
+    routers.slash = {
+      rule = "Host(`slash.tr.m3ta.dev`)";
+      tls = {
+        certResolver = "godaddy";
+      };
+      service = "slash";
+      entrypoints = "websecure";
+    };
+  };
+}

hosts/m3-zelda/services/default.nix

@@ -0,0 +1,7 @@
+{
+  imports = [
+    ./containers
+    ./podman.nix
+    ./traefik.nix
+  ];
+}

hosts/m3-zelda/services/podman.nix

@@ -0,0 +1,20 @@
+{pkgs, ...}: {
+  virtualisation = {
+    podman = {
+      enable = true;
+      dockerCompat = true;
+      autoPrune = {
+        enable = true;
+        dates = "weekly";
+        flags = [
+          "--filter=until=24h"
+          "--filter=label!=important"
+        ];
+      };
+      defaultNetwork.settings.dns_enabled = true;
+    };
+  };
+  environment.systemPackages = with pkgs; [
+    podman-compose
+  ];
+}

hosts/m3-zelda/services/traefik.nix

@@ -0,0 +1,77 @@
+{
+  services.traefik = {
+    enable = true;
+    staticConfigOptions = {
+      log = {
+        level = "WARN";
+      };
+      api = {}; # enable API handler
+      entryPoints = {
+        web = {
+          address = ":80";
+          http.redirections.entryPoint = {
+            to = "websecure";
+            scheme = "https";
+          };
+        };
+        websecure = {
+          address = ":443";
+        };
+      };
+      certificatesResolvers = {
+        godaddy = {
+          acme = {
+            email = "letsencrypt.org.btlc2@passmail.net";
+            storage = "/var/lib/traefik/acme.json";
+            caserver = "https://acme-v02.api.letsencrypt.org/directory";
+            dnsChallenge = {
+              provider = "godaddy";
+              resolvers = ["1.1.1.1:53" "8.8.8.8:53"];
+              propagation.delayBeforeChecks = 120; # Important: Increase delay for slow DNS propagation
+            };
+          };
+        };
+      };
+    };
+    dynamicConfigOptions = {
+      http = {
+        middlewares = {
+          auth = {
+            basicAuth = {
+              users = ["m3tam3re:$apr1$6LQhXb/m$xUqwJYKJwFarhnga5cM.n/"];
+            };
+          };
+        };
+        routers = {
+          api = {
+            rule = "Host(`p.tr.m3ta.dev`)";
+            service = "api@internal";
+            entrypoints = ["websecure"];
+            middlewares = ["auth"];
+            tls = {
+              certResolver = "godaddy";
+            };
+          };
+        };
+      };
+    };
+  };
+
+  system.activationScripts.traefikEnv = {
+    text = ''
+      echo "Creating Traefik env file..."
+      cat > /var/lib/traefik/env << 'EOF'
+      GODADDY_API_KEY=supersecretkey
+      GODADDY_API_SECRET=supersecretsecret
+      EOF
+      chmod 600 /var/lib/traefik/env
+    '';
+    deps = [];
+  };
+
+  systemd.services.traefik.serviceConfig = {
+    EnvironmentFile = ["/var/lib/traefik/env"];
+  };
+
+  networking.firewall.allowedTCPPorts = [80 443];
+}