# Traefik Reverse Proxy
# Deploy: nomad job run traefik.nomad.hcl

job "traefik" {
  datacenters = ["hf-dc1"]
  type        = "system"  # Runs on every client node

  group "traefik" {
    network {
      port "http" {
        static = 80
      }
      port "https" {
        static = 443
      }
      port "dashboard" {
        static = 8080
      }
    }

    service {
      name = "traefik"
      port = "https"
      
      tags = [
        "traefik.enable=true",
        "traefik.http.routers.dashboard.rule=Host(`traefik.hobbs.farm`)",
        "traefik.http.routers.dashboard.service=api@internal",
      ]

      check {
        type     = "http"
        path     = "/ping"
        port     = "dashboard"
        interval = "10s"
        timeout  = "2s"
      }
    }

    task "traefik" {
      driver = "docker"

      config {
        image        = "traefik:v3.0"
        network_mode = "host"
        
        volumes = [
          "local/traefik.yml:/etc/traefik/traefik.yml:ro",
          "local/dynamic:/etc/traefik/dynamic:ro",
        ]
      }

      template {
        destination = "local/traefik.yml"
        data        = <<-EOF
          api:
            dashboard: true
            insecure: true
          
          ping:
            entryPoint: dashboard
          
          entryPoints:
            web:
              address: ":80"
              http:
                redirections:
                  entryPoint:
                    to: websecure
                    scheme: https
            websecure:
              address: ":443"
            dashboard:
              address: ":8080"
          
          providers:
            consulCatalog:
              prefix: traefik
              exposedByDefault: false
              endpoint:
                address: 127.0.0.1:8500
            file:
              directory: /etc/traefik/dynamic
              watch: true
          
          certificatesResolvers:
            letsencrypt:
              acme:
                email: jeremydanielhobbs@gmail.com
                storage: /etc/traefik/acme.json
                dnsChallenge:
                  provider: cloudflare
                  resolvers:
                    - "1.1.1.1:53"
                    - "8.8.8.8:53"
          
          log:
            level: INFO
          
          accessLog: {}
        EOF
      }

      template {
        destination = "local/dynamic/.keep"
        data        = "# Dynamic config directory"
      }

      env {
        CF_API_EMAIL = "" # Set via Nomad variables or Vault
        CF_API_KEY   = "" # Set via Nomad variables or Vault
      }

      resources {
        cpu    = 200
        memory = 256
      }
    }
  }
}