From c4b5c47aa49f286d4d6dc80be5191f19a0056e64 Mon Sep 17 00:00:00 2001
From: sora-ext <sora.ext@helcel.net>
Date: Tue, 12 May 2026 17:45:16 +0200
Subject: [PATCH] Update modules/server/containers/apps/traefik.nix

---
 modules/server/containers/apps/traefik.nix | 12 ++++++++----
 1 file changed, 8 insertions(+), 4 deletions(-)

diff --git a/modules/server/containers/apps/traefik.nix b/modules/server/containers/apps/traefik.nix
index 5f2ef02..5faac52 100644
--- a/modules/server/containers/apps/traefik.nix
+++ b/modules/server/containers/apps/traefik.nix
@@ -11,6 +11,7 @@ let
     };
   };
 in {
+  sops = true;
   paths = [{
     path="${serverCfg.configPath}/traefik";
     owner = "1000:1000";
@@ -21,7 +22,6 @@ in {
     server = builder.mkContainer {
       imageStream = image;
       subdomain = containerCfg.subdomain;
-      ip = containerCfg.ip;
       port = 8080;
       secret = name;
       extraLabels = {
@@ -55,15 +55,19 @@ in {
           "--entrypoints.web.http.redirections.entrypoint.scheme=https"
           "--entrypoints.web-secure.transport.respondingtimeouts.readtimeout=0s"
           "--entrypoints.web-secure.proxyprotocol.trustedips=127.0.0.1/32,192.168.1.1/16,10.10.0.0/16"
-        ] ++ (if containerCfg.extra ? provider then [
+        ] ++ (if serverCfg.containers ? umami  then [
+          "--experimental.plugins.umami-feeder.moduleName=github.com/astappiev/traefik-umami-feeder"
+          "--experimental.plugins.umami-feeder.version=v1.4.1"
+          "--entrypoints.web-secure.http.middlewares=umami-global@docker"
+        ] else []) ++ (if containerCfg.extra ? provider then [
           "--certificatesresolvers.default.acme.email=acme@${serverCfg.hostDomain}"
           "--certificatesresolvers.default.acme.dnschallenge=true"
           "--certificatesresolvers.default.acme.dnschallenge.provider=${containerCfg.extra.provider}"
           "--certificatesresolvers.default.acme.storage=/custom/acme.json"
-        ] else (if serverCfg.hostDomain != "localhost" then [
+        ] else []) ++ (if serverCfg.hostDomain != "localhost" then [
           "--certificatesresolvers.default.acme.httpchallenge=false"
           "--certificatesresolvers.default.acme.tlschallenge=true"
-        ] else [ ]));
+        ] else []);
         ports = [ "443:443" "80:80" ] ++ (if containerCfg.port!=null then [ "${toString containerCfg.port}:8080" ] else []);
         volumes = [
           "/var/run/podman/podman.sock:/var/run/docker.sock"