homelab-nomad/traefik/traefik.nomad
Ian Fijolek 37c6fd4735 Make traefik a system service
For this to work, will need to put TLS certs in Vault
2022-06-17 15:20:43 -07:00

188 lines
4.2 KiB
HCL

variable "consul_address" {
type = string
description = "Full address of Consul instance to get catalog from"
default = "http://127.0.0.1:5400"
}
variable "base_hostname" {
type = string
description = "Base hostname to serve content from"
default = "dev.homelab"
}
job "traefik" {
region = "global"
datacenters = ["dc1"]
type = "system"
constraint {
attribute = "${node.class}"
value = "ingress"
}
group "traefik" {
network {
port "web" {
static = 80
}
port "websecure" {
static = 443
}
}
service {
name = "traefik"
port = "web"
check {
type = "http"
path = "/ping"
port = "web"
interval = "10s"
timeout = "2s"
}
connect {
native = true
}
tags = [
"traefik.enable=true",
"traefik.http.routers.traefik_dashboard.entryPoints=websecure",
"traefik.http.routers.traefik_dashboard.rule=Host(`traefik.${var.base_hostname}`)",
"traefik.http.routers.traefik_dashboard.service=api@internal",
"traefik.http.routers.traefik_dashboard.tls=true",
]
}
task "traefik" {
driver = "docker"
config {
image = "traefik:2.6"
ports = ["web", "websecure"]
network_mode = "host"
mount {
type = "bind"
target = "/etc/traefik"
source = "config"
}
}
template {
# Avoid conflict with TOML lists [[ ]] and Go templates {{ }}
left_delimiter = "<<"
right_delimiter = ">>"
data = <<EOH
[log]
level = "DEBUG"
[entryPoints]
[entryPoints.web]
address = ":80"
[entryPoints.web.http]
[entryPoints.web.http.redirections]
[entryPoints.web.http.redirections.entrypoint]
to = "websecure"
scheme = "https"
[entryPoints.websecure]
address = ":443"
[entryPoints.websecure.http.tls]
# certResolver = "letsEncrypt"
[entryPoints.metrics]
address = ":8989"
[api]
dashboard = true
[ping]
entrypoint = "web"
[metrics]
[metrics.prometheus]
entrypoint = "metrics"
# manualRouting = true
[providers.file]
directory = "/etc/traefik/conf"
watch = true
[providers.consulCatalog]
connectAware = true
connectByDefault = true
exposedByDefault = false
defaultRule = "Host(`{{normalize .Name}}.${var.base_hostname}`)"
[providers.consulCatalog.endpoint]
address = "http://<< env "CONSUL_HTTP_ADDR" >>"
EOH
destination = "/config/traefik.toml"
}
template {
# Avoid conflict with TOML lists [[ ]] and Go templates {{ }}
left_delimiter = "<<"
right_delimiter = ">>"
data = <<EOH
[http]
[http.routers]
[http.routers.nomad]
entryPoints = ["websecure"]
# middlewares = []
service = "nomad"
rule = "Host(`nomad.${var.base_hostname}`)"
[http.routers.consul]
entryPoints = ["websecure"]
# middlewares = []
service = "consul"
rule = "Host(`consul.${var.base_hostname}`)"
[http.routers.vault]
entryPoints = ["websecure"]
# middlewares = []
service = "vault"
rule = "Host(`vault.${var.base_hostname}`)"
[http.services]
<< with service "nomad-client" ->>
[http.services.nomad]
[http.services.nomad.loadBalancer]
<< range . ->>
[[http.services.nomad.loadBalancer.servers]]
url = "http://<< .Address >>:<< .Port >>"
<< end >>
<<- end >>
<< with service "consul" ->>
[http.services.consul]
[http.services.consul.loadBalancer]
<< range . ->>
[[http.services.consul.loadBalancer.servers]]
# Not using .Port because that's an RPC port
url = "http://<< .Address >>:8500"
<< end >>
<<- end >>
<< with service "vault" ->>
[http.services.vault]
[http.services.vault.loadBalancer]
<< range . ->>
[[http.services.vault.loadBalancer.servers]]
url = "http://<< .Address >>:<< .Port >>"
<< end >>
<<- end >>
EOH
destination = "/config/conf/route-hashi.toml"
change_mode = "noop"
}
resources {
cpu = 50
memory = 50
}
}
}
}