110 lines
2.7 KiB
HCL
110 lines
2.7 KiB
HCL
job "traefik" {
|
|
region = "global"
|
|
datacenters = ["dc1"]
|
|
type = "service"
|
|
|
|
group "traefik" {
|
|
count = 1
|
|
|
|
network {
|
|
port "http" {
|
|
static = 80
|
|
}
|
|
|
|
port "https" {
|
|
static = 443
|
|
}
|
|
|
|
port "api" {
|
|
static = 8081
|
|
}
|
|
}
|
|
|
|
service {
|
|
name = "traefik"
|
|
port = "api"
|
|
|
|
check {
|
|
name = "alive"
|
|
type = "tcp"
|
|
port = "http"
|
|
interval = "10s"
|
|
timeout = "2s"
|
|
}
|
|
|
|
tags = [
|
|
"traefik.enable=true",
|
|
|
|
// Redirect all http requests to HTTPS
|
|
"traefik.http.middlewares.https-redirect.redirectscheme.permanent=true",
|
|
"traefik.http.middlewares.https-redirect.redirectscheme.scheme=https",
|
|
"traefik.http.routers.http-catchall.entrypoints=http",
|
|
"traefik.http.routers.http-catchall.rule=HostRegexp(`{any:.+}`)",
|
|
"traefik.http.routers.http-catchall.middlewares=https-redirect",
|
|
|
|
// Forward requests to protected services to Authelia. Remove this if not running Authelia.
|
|
"traefik.http.middlewares.authelia.forwardauth.address=http://<authelia address>/api/verify?rd=https://auth.arsenm.dev/",
|
|
"traefik.http.middlewares.authelia.forwardauth.trustforwardheader=true",
|
|
"traefik.http.middlewares.authelia.forwardauth.authresponseheaders=Remote-User, Remote-Groups",
|
|
|
|
// Expose Traefik API with authentication. Remove this if not running Authelia.
|
|
"traefik.http.routers.traefik.rule=Host(`traefik.arsenm.dev`)",
|
|
"traefik.http.routers.traefik.tls.certResolver=letsencrypt",
|
|
"traefik.http.routers.traefik.middlewares=authelia",
|
|
]
|
|
}
|
|
|
|
task "traefik" {
|
|
driver = "docker"
|
|
|
|
config {
|
|
image = "traefik:v2.2"
|
|
network_mode = "host"
|
|
|
|
volumes = [
|
|
"/opt/traefik/acme.json:/acme.json",
|
|
"local/traefik.toml:/etc/traefik/traefik.toml",
|
|
]
|
|
}
|
|
|
|
template {
|
|
data = <<EOF
|
|
[entryPoints]
|
|
[entryPoints.http]
|
|
address = ":80"
|
|
[entryPoints.https]
|
|
address = ":443"
|
|
[entryPoints.traefik]
|
|
address = ":8081"
|
|
|
|
[certificatesResolvers.letsencrypt.acme]
|
|
email = "you@example.com"
|
|
storage = "acme.json"
|
|
[certificatesResolvers.letsencrypt.acme.httpChallenge]
|
|
entryPoint = "http"
|
|
|
|
[api]
|
|
dashboard = true
|
|
insecure = true
|
|
|
|
# Enable Consul Catalog configuration backend.
|
|
[providers.consulCatalog]
|
|
prefix = "traefik"
|
|
exposedByDefault = false
|
|
|
|
[providers.consulCatalog.endpoint]
|
|
address = "127.0.0.1:8500"
|
|
scheme = "http"
|
|
EOF
|
|
|
|
destination = "local/traefik.toml"
|
|
}
|
|
|
|
resources {
|
|
cpu = 100
|
|
memory = 128
|
|
}
|
|
}
|
|
}
|
|
}
|