Update Traefik with Cloudflare credentials

nomad-jobs/traefik.nomad.hcl

@@ -1,9 +1,9 @@
-# Traefik Reverse Proxy
+# Traefik Reverse Proxy for hobbs.farm
 # Deploy: nomad job run traefik.nomad.hcl
 
 job "traefik" {
   datacenters = ["hf-dc1"]
-  type        = "system"  # Runs on every client node
+  type        = "system"
 
   group "traefik" {
     network {
@@ -13,27 +13,28 @@ job "traefik" {
       port "https" {
         static = 443
       }
-      port "dashboard" {
+      port "api" {
-        static = 8080
+        static = 8088
       }
     }
 
+    volume "traefik-data" {
+      type      = "host"
+      source    = "traefik-data"
+      read_only = false
+    }
+
     service {
       name = "traefik"
       port = "https"
-      
+      tags = ["reverse-proxy", "traefik"]
-      tags = [
-        "traefik.enable=true",
-        "traefik.http.routers.dashboard.rule=Host(`traefik.hobbs.farm`)",
-        "traefik.http.routers.dashboard.service=api@internal",
-      ]
 
       check {
         type     = "http"
         path     = "/ping"
-        port     = "dashboard"
+        port     = "api"
         interval = "10s"
-        timeout  = "2s"
+        timeout  = "3s"
       }
     }
 
@@ -50,6 +51,11 @@ job "traefik" {
         ]
       }
 
+      volume_mount {
+        volume      = "traefik-data"
+        destination = "/data"
+      }
+
       template {
         destination = "local/traefik.yml"
         data = <<-EOF
@@ -58,7 +64,7 @@ job "traefik" {
           insecure: true
 
         ping:
-            entryPoint: dashboard
+          entryPoint: api
 
         entryPoints:
           web:
@@ -70,8 +76,8 @@ job "traefik" {
                   scheme: https
           websecure:
             address: ":443"
-            dashboard:
+          api:
-              address: ":8080"
+            address: ":8088"
 
         providers:
           consulCatalog:
@@ -86,8 +92,8 @@ job "traefik" {
         certificatesResolvers:
           letsencrypt:
             acme:
-                email: jeremydanielhobbs@gmail.com
+              email: jeremy@hobbs.farm
-                storage: /etc/traefik/acme.json
+              storage: /data/acme.json
               dnsChallenge:
                 provider: cloudflare
                 resolvers:
@@ -102,13 +108,55 @@ job "traefik" {
       }
 
       template {
-        destination = "local/dynamic/.keep"
+        destination = "local/dynamic/media.yml"
-        data        = "# Dynamic config directory"
+        data = <<-EOF
+        http:
+          routers:
+            jellyfin:
+              rule: "Host(`r2d2.hobbs.farm`)"
+              entryPoints:
+                - websecure
+              service: jellyfin
+              tls:
+                certResolver: letsencrypt
+
+            sonarr:
+              rule: "Host(`sonarr.hobbs.farm`)"
+              entryPoints:
+                - websecure
+              service: sonarr
+              tls:
+                certResolver: letsencrypt
+
+            radarr:
+              rule: "Host(`radarr.hobbs.farm`)"
+              entryPoints:
+                - websecure
+              service: radarr
+              tls:
+                certResolver: letsencrypt
+
+          services:
+            jellyfin:
+              loadBalancer:
+                servers:
+                  - url: "http://192.168.86.192:8096"
+
+            sonarr:
+              loadBalancer:
+                servers:
+                  - url: "http://192.168.86.192:8989"
+
+            radarr:
+              loadBalancer:
+                servers:
+                  - url: "http://192.168.86.192:7878"
+        EOF
       }
 
+      # Cloudflare credentials for Let's Encrypt DNS challenge
       env {
-        CF_API_EMAIL = "" # Set via Nomad variables or Vault
+        CF_DNS_API_TOKEN = "PWhuBvaYrh85S-iwBqQz4HFZV4c645znc8_eG7V9"
-        CF_API_KEY   = "" # Set via Nomad variables or Vault
       }
 
       resources {