homelab-nomad/core/traefik/traefik.nomad

334 lines
7.3 KiB
Plaintext
Raw Normal View History

2022-02-16 17:56:18 +00:00
job "traefik" {
datacenters = ["dc1"]
type = "service"
2022-06-23 16:51:42 +00:00
priority = 100
2022-02-16 17:56:18 +00:00
constraint {
attribute = "${node.class}"
value = "ingress"
}
constraint {
distinct_hosts = true
}
update {
max_parallel = 1
2024-05-28 18:43:46 +00:00
canary = 1
auto_promote = false
auto_revert = true
2024-05-28 18:43:46 +00:00
min_healthy_time = "30s"
healthy_deadline = "5m"
}
2022-02-16 17:56:18 +00:00
group "traefik" {
2024-01-04 21:24:15 +00:00
count = 2
2022-02-16 17:56:18 +00:00
network {
port "web" {
static = 80
}
2022-02-16 17:56:18 +00:00
port "websecure" {
static = 443
}
port "syslog" {
static = 514
}
port "gitssh" {
static = 2222
}
port "metrics" {}
dns {
servers = [
"192.168.2.101",
"192.168.2.102",
"192.168.2.30",
]
}
2022-02-16 17:56:18 +00:00
}
2022-07-28 00:30:35 +00:00
ephemeral_disk {
migrate = true
sticky = true
}
2022-02-16 17:56:18 +00:00
task "traefik" {
driver = "docker"
2024-01-23 20:08:47 +00:00
service {
name = "traefik"
provider = "nomad"
port = "web"
check {
type = "http"
path = "/ping"
interval = "10s"
timeout = "2s"
}
tags = [
"traefik.enable=true",
"traefik.http.routers.traefik.entryPoints=websecure",
"traefik.http.routers.traefik.service=api@internal",
]
}
service {
name = "traefik-metrics"
provider = "nomad"
port = "metrics"
tags = [
"prometheus.scrape",
]
}
2022-02-16 17:56:18 +00:00
config {
2024-05-28 18:43:46 +00:00
image = "traefik:3.0"
2022-02-16 17:56:18 +00:00
ports = ["web", "websecure", "syslog", "gitssh", "metrics"]
2022-02-16 17:56:18 +00:00
network_mode = "host"
2022-03-14 22:58:03 +00:00
mount {
type = "bind"
target = "/etc/traefik"
2022-07-27 04:45:06 +00:00
source = "local/config"
2022-03-14 22:58:03 +00:00
}
2022-07-27 04:45:06 +00:00
mount {
type = "bind"
target = "/etc/traefik/usersfile"
source = "secrets/usersfile"
}
mount {
type = "bind"
target = "/etc/traefik/certs"
source = "secrets/certs"
}
2022-07-27 04:45:06 +00:00
}
2024-05-28 19:00:13 +00:00
env = {
TRAEFIK_PROVIDERS_NOMAD_ENDPOINT_TOKEN = "${NOMAD_TOKEN}"
}
identity {
env = true
}
2022-03-14 22:58:03 +00:00
template {
# Avoid conflict with TOML lists [[ ]] and Go templates {{ }}
left_delimiter = "<<"
right_delimiter = ">>"
data = <<EOH
[log]
level = "DEBUG"
[entryPoints]
[entryPoints.web]
address = ":80"
[entryPoints.web.http]
[entryPoints.web.http.redirections]
[entryPoints.web.http.redirections.entrypoint]
to = "websecure"
scheme = "https"
[entryPoints.websecure]
address = ":443"
[entryPoints.websecure.http.tls]
[entryPoints.metrics]
2024-02-18 15:47:31 +00:00
address = ":<< env "NOMAD_PORT_metrics" >>"
2022-03-14 22:58:03 +00:00
2022-09-04 19:36:26 +00:00
[entryPoints.syslogtcp]
address = ":514"
[entryPoints.syslogudp]
address = ":514/udp"
[entryPoints.gitssh]
address = ":2222"
2022-03-14 22:58:03 +00:00
[api]
dashboard = true
[ping]
entrypoint = "web"
[metrics]
[metrics.prometheus]
entrypoint = "metrics"
# manualRouting = true
[providers.file]
directory = "/etc/traefik/conf"
watch = true
[providers.nomad]
exposedByDefault = false
defaultRule = "Host(`{{normalize .Name}}.<< with nomadVar "nomad/jobs" >><< .base_hostname >><< end >>`)"
[providers.nomad.endpoint]
2024-05-28 19:00:13 +00:00
address = "unix:///secrets/api.sock"
2022-03-14 22:58:03 +00:00
EOH
destination = "${NOMAD_TASK_DIR}/config/traefik.toml"
}
2022-03-14 22:58:03 +00:00
template {
data = <<EOH
[http]
[http.routers]
[http.routers.nomad]
2022-03-15 18:57:00 +00:00
entryPoints = ["websecure"]
2022-03-14 22:58:03 +00:00
service = "nomad"
rule = "Host(`nomad.{{ with nomadVar "nomad/jobs" }}{{ .base_hostname }}{{ end }}`)"
2024-08-22 03:02:18 +00:00
{{ range nomadVarList "traefik_external" }}{{ with nomadVar .Path }}
[http.routers.{{ .name }}]
entryPoints = ["websecure"]
2024-08-22 03:02:18 +00:00
service = "{{ .name }}"
rule = "Host(`{{ .subdomain }}.{{ with nomadVar "nomad/jobs" }}{{ .base_hostname }}{{ end }}`){{ with .path_prefix.Value }}&&PathPrefix(`{{ . }}`){{ end }}"
{{ $name := .name -}}
{{ with .path_prefix.Value -}}
middlewares = ["{{ $name }}@file"]
{{ end }}
{{- end }}{{ end }}
#[http.middlewares]
# {{ range nomadVarList "traefik_external" }}{{ with nomadVar .Path -}}
# {{ $name := .name -}}
# {{ with .path_prefix.Value -}}
# [http.middlewares.{{ $name }}.stripPrefix]
# prefixes = ["{{ . }}"]
# {{ end }}
# {{- end }}{{ end }}
2022-03-14 22:58:03 +00:00
[http.services]
[http.services.nomad]
[http.services.nomad.loadBalancer]
[[http.services.nomad.loadBalancer.servers]]
url = "http://127.0.0.1:4646"
2024-08-22 03:02:18 +00:00
{{ range nomadVarList "traefik_external" }}{{ with nomadVar .Path }}
[http.services.{{ .name }}]
[http.services.{{ .name }}.loadBalancer]
[[http.services.{{ .name }}.loadBalancer.servers]]
url = "{{ .url }}"
{{- end }}{{ end }}
2022-07-27 04:45:06 +00:00
EOH
destination = "${NOMAD_TASK_DIR}/config/conf/route-hashi.toml"
2022-07-27 04:45:06 +00:00
change_mode = "noop"
splay = "1m"
wait {
min = "10s"
max = "20s"
}
2022-07-27 04:45:06 +00:00
}
template {
data = <<EOH
{{ with nomadService "syslogng" -}}
[tcp.routers]
[tcp.routers.syslogtcp]
entryPoints = ["syslogtcp"]
service = "syslogngtcp"
rule = "HostSNI(`*`)"
[tcp.services]
[tcp.services.syslogngtcp]
[tcp.services.syslogngtcp.loadBalancer]
{{ range . -}}
[[tcp.services.syslogngtcp.loadBalancer.servers]]
address = "{{ .Address }}:{{ .Port }}"
{{ end -}}
{{- end }}
{{ with nomadService "syslogng" -}}
[udp.routers]
[udp.routers.syslogudp]
entryPoints = ["syslogudp"]
service = "syslogngudp"
[udp.services]
[udp.services.syslogngudp]
[udp.services.syslogngudp.loadBalancer]
{{ range . -}}
[[udp.services.syslogngudp.loadBalancer.servers]]
address = "{{ .Address }}:{{ .Port }}"
{{ end -}}
{{- end }}
EOH
destination = "${NOMAD_TASK_DIR}/config/conf/route-syslog-ng.toml"
change_mode = "noop"
splay = "1m"
wait {
min = "10s"
max = "20s"
}
}
template {
data = <<EOF
{{- with nomadVar "secrets/certs/_lego/certificates/__thefij_rocks_crt" }}{{ .contents }}{{ end -}}"
EOF
destination = "${NOMAD_SECRETS_DIR}/certs/_.thefij.rocks.crt"
change_mode = "noop"
}
template {
data = <<EOF
{{- with nomadVar "secrets/certs/_lego/certificates/__thefij_rocks_key" }}{{ .contents }}{{ end -}}"
EOF
destination = "${NOMAD_SECRETS_DIR}/certs/_.thefij.rocks.key"
change_mode = "noop"
}
template {
data = <<EOH
[[tls.certificates]]
certFile = "/etc/traefik/certs/_.thefij.rocks.crt"
keyFile = "/etc/traefik/certs/_.thefij.rocks.key"
EOH
destination = "${NOMAD_TASK_DIR}/config/conf/dynamic-tls.toml"
change_mode = "noop"
}
2022-07-27 04:45:06 +00:00
template {
data = <<EOH
[http.middlewares]
{{ with nomadVar "nomad/jobs/traefik" }}
{{ if .usersfile }}
2022-07-27 04:45:06 +00:00
[http.middlewares.basic-auth.basicAuth]
usersFile = "/etc/traefik/usersfile"
{{- end }}
{{- end }}
2022-07-27 04:45:06 +00:00
EOH
destination = "${NOMAD_TASK_DIR}/config/conf/middlewares.toml"
2022-07-27 04:45:06 +00:00
change_mode = "noop"
}
template {
data = <<EOH
{{ with nomadVar "nomad/jobs/traefik" -}}
{{ .usersfile }}
{{- end }}
2022-03-14 22:58:03 +00:00
EOH
destination = "${NOMAD_SECRETS_DIR}/usersfile"
2022-03-14 22:58:03 +00:00
change_mode = "noop"
2022-02-16 17:56:18 +00:00
}
resources {
2022-07-25 22:51:16 +00:00
cpu = 100
2023-07-31 17:43:03 +00:00
memory = 150
2022-02-16 17:56:18 +00:00
}
}
}
}