# Traefik Reverse Proxy for hobbs.farm
# Deploy: nomad job run traefik.nomad.hcl

job "traefik" {
  datacenters = ["hf-dc1"]
  type        = "system"

  group "traefik" {
    network {
      port "http" {
        static = 80
      }
      port "https" {
        static = 443
      }
      port "api" {
        static = 8088
      }
    }

    volume "traefik-data" {
      type      = "host"
      source    = "traefik-data"
      read_only = false
    }

    service {
      name = "traefik"
      port = "https"
      tags = ["reverse-proxy", "traefik"]

      check {
        type     = "http"
        path     = "/ping"
        port     = "api"
        interval = "10s"
        timeout  = "3s"
      }
    }

    task "traefik" {
      driver = "docker"

      config {
        image        = "traefik:v3.0"
        network_mode = "host"

        volumes = [
          "local/traefik.yml:/etc/traefik/traefik.yml:ro",
          "local/dynamic:/etc/traefik/dynamic:ro",
        ]
      }

      volume_mount {
        volume      = "traefik-data"
        destination = "/data"
      }

      template {
        destination = "local/traefik.yml"
        data = <<-EOF
        api:
          dashboard: true
          insecure: true

        ping:
          entryPoint: api

        entryPoints:
          web:
            address: ":80"
            http:
              redirections:
                entryPoint:
                  to: websecure
                  scheme: https
          websecure:
            address: ":443"
          api:
            address: ":8088"

        providers:
          consulCatalog:
            prefix: traefik
            exposedByDefault: false
            endpoint:
              address: 127.0.0.1:8500
          file:
            directory: /etc/traefik/dynamic
            watch: true

        certificatesResolvers:
          letsencrypt:
            acme:
              email: jeremy@hobbs.farm
              storage: /data/acme.json
              dnsChallenge:
                provider: cloudflare
                resolvers:
                  - "1.1.1.1:53"
                  - "8.8.8.8:53"

        log:
          level: INFO

        accessLog: {}
        EOF
      }

      template {
        destination = "local/dynamic/media.yml"
        data = <<-EOF
        http:
          routers:
            jellyfin:
              rule: "Host(`r2d2.hobbs.farm`)"
              entryPoints:
                - websecure
              service: jellyfin
              tls:
                certResolver: letsencrypt

            sonarr:
              rule: "Host(`sonarr.hobbs.farm`)"
              entryPoints:
                - websecure
              service: sonarr
              tls:
                certResolver: letsencrypt

            radarr:
              rule: "Host(`radarr.hobbs.farm`)"
              entryPoints:
                - websecure
              service: radarr
              tls:
                certResolver: letsencrypt

          services:
            jellyfin:
              loadBalancer:
                servers:
                  - url: "http://192.168.86.192:8096"

            sonarr:
              loadBalancer:
                servers:
                  - url: "http://192.168.86.192:8989"

            radarr:
              loadBalancer:
                servers:
                  - url: "http://192.168.86.192:7878"
        EOF
      }

      # Cloudflare credentials for Let's Encrypt DNS challenge
      env {
        CF_DNS_API_TOKEN = "PWhuBvaYrh85S-iwBqQz4HFZV4c645znc8_eG7V9"
      }

      resources {
        cpu    = 200
        memory = 256
      }
    }
  }
}