homelab-nomad/core/traefik/traefik.nomad

303 lines
6.9 KiB
Plaintext
Raw Normal View History

2022-02-16 17:56:18 +00:00
variable "base_hostname" {
type = string
description = "Base hostname to serve content from"
default = "dev.homelab"
}
job "traefik" {
datacenters = ["dc1"]
type = "service"
2022-06-23 16:51:42 +00:00
priority = 100
2022-02-16 17:56:18 +00:00
constraint {
attribute = "${node.class}"
value = "ingress"
}
constraint {
distinct_hosts = true
}
update {
max_parallel = 1
# canary = 1
# auto_promote = true
auto_revert = true
}
2022-02-16 17:56:18 +00:00
group "traefik" {
count = 1
2022-02-16 17:56:18 +00:00
network {
port "web" {
static = 80
}
2022-02-16 17:56:18 +00:00
port "websecure" {
static = 443
}
port "syslog" {
static = 514
}
2022-02-16 17:56:18 +00:00
}
2022-07-28 00:30:35 +00:00
ephemeral_disk {
migrate = true
sticky = true
}
2022-02-16 17:56:18 +00:00
service {
name = "traefik"
port = "web"
check {
type = "http"
path = "/ping"
port = "web"
interval = "10s"
timeout = "2s"
}
connect {
native = true
}
tags = [
"traefik.enable=true",
"traefik.http.routers.traefik.entryPoints=websecure",
"traefik.http.routers.traefik.service=api@internal",
2022-02-16 17:56:18 +00:00
]
}
task "traefik" {
driver = "docker"
config {
2022-11-15 23:55:11 +00:00
image = "traefik:2.9"
2022-02-16 17:56:18 +00:00
ports = ["web", "websecure"]
network_mode = "host"
2022-03-14 22:58:03 +00:00
mount {
type = "bind"
target = "/etc/traefik"
2022-07-27 04:45:06 +00:00
source = "local/config"
2022-03-14 22:58:03 +00:00
}
2022-07-27 04:45:06 +00:00
mount {
type = "bind"
target = "/etc/traefik/usersfile"
source = "secrets/usersfile"
}
}
vault {
policies = ["access-tables", "nomad-task"]
2022-03-14 22:58:03 +00:00
}
template {
# Avoid conflict with TOML lists [[ ]] and Go templates {{ }}
left_delimiter = "<<"
right_delimiter = ">>"
data = <<EOH
[log]
level = "DEBUG"
[entryPoints]
[entryPoints.web]
address = ":80"
[entryPoints.web.http]
[entryPoints.web.http.redirections]
[entryPoints.web.http.redirections.entrypoint]
to = "websecure"
scheme = "https"
[entryPoints.websecure]
address = ":443"
[entryPoints.websecure.http.tls]
<< if keyExists "traefik/acme/email" ->>
certResolver = "letsEncrypt"
2022-07-28 22:11:24 +00:00
[[entryPoints.websecure.http.tls.domains]]
main = "*.<< keyOrDefault "global/base_hostname" "${var.base_hostname}" >>"
<< end ->>
2022-03-14 22:58:03 +00:00
[entryPoints.metrics]
address = ":8989"
2022-09-04 19:36:26 +00:00
[entryPoints.syslogtcp]
address = ":514"
[entryPoints.syslogudp]
address = ":514/udp"
2022-03-14 22:58:03 +00:00
[api]
dashboard = true
[ping]
entrypoint = "web"
[metrics]
[metrics.prometheus]
entrypoint = "metrics"
# manualRouting = true
[providers.file]
directory = "/etc/traefik/conf"
watch = true
[providers.consulCatalog]
connectAware = true
connectByDefault = true
exposedByDefault = false
defaultRule = "Host(`{{normalize .Name}}.<< keyOrDefault "global/base_hostname" "${var.base_hostname}" >>`)"
2022-03-14 22:58:03 +00:00
[providers.consulCatalog.endpoint]
address = "http://<< env "CONSUL_HTTP_ADDR" >>"
<< if keyExists "traefik/acme/email" ->>
[certificatesResolvers.letsEncrypt.acme]
email = "<< key "traefik/acme/email" >>"
# Store in /local because /secrets doesn't persist with ephemeral disk
storage = "/local/acme.json"
[certificatesResolvers.letsEncrypt.acme.dnsChallenge]
provider = "cloudflare"
resolvers = ["1.1.1.1:53", "8.8.8.8:53"]
delayBeforeCheck = 0
<< end ->>
2022-03-14 22:58:03 +00:00
EOH
2022-07-27 04:45:06 +00:00
destination = "local/config/traefik.toml"
2022-03-14 22:58:03 +00:00
}
template {
data = <<EOH
{{ with secret "kv/data/cloudflare" }}
2022-11-21 22:25:01 +00:00
CF_DNS_API_TOKEN={{ .Data.data.domain_lego_dns }}
CF_ZONE_API_TOKEN={{ .Data.data.domain_lego_dns }}
{{ end }}
EOH
destination = "secrets/cloudflare.env"
env = true
}
2022-03-14 22:58:03 +00:00
template {
data = <<EOH
[http]
[http.routers]
[http.routers.nomad]
2022-03-15 18:57:00 +00:00
entryPoints = ["websecure"]
2022-03-14 22:58:03 +00:00
# middlewares = []
service = "nomad"
2022-07-27 04:45:06 +00:00
rule = "Host(`nomad.{{ keyOrDefault "global/base_hostname" "${var.base_hostname}" }}`)"
2022-03-14 22:58:03 +00:00
[http.routers.consul]
2022-03-15 18:57:00 +00:00
entryPoints = ["websecure"]
2022-03-14 22:58:03 +00:00
# middlewares = []
service = "consul"
2022-07-27 04:45:06 +00:00
rule = "Host(`consul.{{ keyOrDefault "global/base_hostname" "${var.base_hostname}" }}`)"
2022-03-15 18:57:00 +00:00
[http.routers.vault]
entryPoints = ["websecure"]
# middlewares = []
service = "vault"
2022-07-27 04:45:06 +00:00
rule = "Host(`vault.{{ keyOrDefault "global/base_hostname" "${var.base_hostname}" }}`)"
2022-03-14 22:58:03 +00:00
[http.services]
2022-07-27 04:45:06 +00:00
{{ with service "nomad-client" -}}
2022-03-14 22:58:03 +00:00
[http.services.nomad]
[http.services.nomad.loadBalancer]
2022-07-27 04:45:06 +00:00
{{ range . -}}
2022-03-14 22:58:03 +00:00
[[http.services.nomad.loadBalancer.servers]]
2022-07-27 04:45:06 +00:00
url = "http://{{ .Address }}:{{ .Port }}"
{{ end }}
{{- end }}
{{ with service "consul" -}}
2022-03-14 22:58:03 +00:00
[http.services.consul]
[http.services.consul.loadBalancer]
2022-07-27 04:45:06 +00:00
{{ range . -}}
2022-03-14 22:58:03 +00:00
[[http.services.consul.loadBalancer.servers]]
2022-04-15 19:25:15 +00:00
# Not using .Port because that's an RPC port
2022-07-27 04:45:06 +00:00
url = "http://{{ .Address }}:8500"
{{ end }}
{{- end }}
{{ with service "vault" -}}
2022-03-15 18:57:00 +00:00
[http.services.vault]
[http.services.vault.loadBalancer]
[http.services.vault.loadBalancer.sticky.cookie]
2022-07-27 04:45:06 +00:00
{{ range . -}}
2022-03-15 18:57:00 +00:00
[[http.services.vault.loadBalancer.servers]]
2022-07-27 04:45:06 +00:00
url = "http://{{ .Address }}:{{ .Port }}"
{{ end }}
{{- end }}
EOH
destination = "local/config/conf/route-hashi.toml"
change_mode = "noop"
}
template {
data = <<EOH
{{ with service "syslogng" -}}
[tcp.routers]
[tcp.routers.syslogtcp]
entryPoints = ["syslogtcp"]
service = "syslogngtcp"
rule = "HostSNI(`*`)"
[tcp.services]
[tcp.services.syslogngtcp]
[tcp.services.syslogngtcp.loadBalancer]
{{ range . -}}
[[tcp.services.syslogngtcp.loadBalancer.servers]]
address = "{{ .Address }}:{{ .Port }}"
{{ end -}}
{{ end }}
{{ with service "syslogng" -}}
[udp.routers]
[udp.routers.syslogudp]
entryPoints = ["syslogudp"]
service = "syslogngudp"
[udp.services]
[udp.services.syslogngudp]
[udp.services.syslogngudp.loadBalancer]
{{ range . -}}
[[udp.services.syslogngudp.loadBalancer.servers]]
address = "{{ .Address }}:{{ .Port }}"
{{ end -}}
{{ end }}
EOH
destination = "local/config/conf/route-syslog-ng.toml"
change_mode = "noop"
}
2022-07-27 04:45:06 +00:00
template {
data = <<EOH
[http.middlewares]
{{ with secret "kv/data/traefik" }}
{{ if .Data.data.usersfile }}
[http.middlewares.basic-auth.basicAuth]
usersFile = "/etc/traefik/usersfile"
{{ end }}
{{ end }}
EOH
destination = "local/config/conf/middlewares.toml"
change_mode = "noop"
}
template {
data = <<EOH
{{ with secret "kv/data/traefik" }}
{{ .Data.data.usersfile }}
{{ end }}
2022-03-14 22:58:03 +00:00
EOH
2022-07-27 04:45:06 +00:00
destination = "secrets/usersfile"
2022-03-14 22:58:03 +00:00
change_mode = "noop"
2022-02-16 17:56:18 +00:00
}
resources {
2022-07-25 22:51:16 +00:00
cpu = 100
memory = 100
memory_max = 500
2022-02-16 17:56:18 +00:00
}
}
}
}