Initial IaC setup: Nomad, Consul, Terraform, Ansible

- Ansible roles for Nomad and Consul installation - Nomad job specs for Traefik and monitoring stack - Terraform configuration for Nomad job management - Enterprise naming convention inventory - HashiCorp stack deployment playbook
2026-02-04 08:52:08 -06:00
commit 3d3c1af237
15 changed files with 998 additions and 0 deletions
@@ -0,0 +1,129 @@
+job "traefik" {
+  datacenters = ["hf-dc1"]
+  type        = "service"
+  
+  # Run on primary node
+  constraint {
+    attribute = "${node.class}"
+    value     = "primary"
+  }
+
+  group "traefik" {
+    count = 1
+
+    network {
+      port "http" {
+        static = 80
+      }
+      port "https" {
+        static = 443
+      }
+      port "api" {
+        static = 8080
+      }
+    }
+
+    service {
+      name = "traefik"
+      port = "https"
+      
+      tags = [
+        "traefik.enable=true",
+        "traefik.http.routers.api.rule=Host(`traefik.hobbs.farm`)",
+        "traefik.http.routers.api.service=api@internal",
+      ]
+
+      check {
+        type     = "http"
+        path     = "/ping"
+        port     = "api"
+        interval = "10s"
+        timeout  = "2s"
+      }
+    }
+
+    task "traefik" {
+      driver = "docker"
+
+      config {
+        image = "traefik:v3.0"
+        
+        ports = ["http", "https", "api"]
+        
+        volumes = [
+          "local/traefik.yml:/etc/traefik/traefik.yml:ro",
+          "local/dynamic:/etc/traefik/dynamic:ro",
+        ]
+        
+        # Mount Docker socket for provider
+        mount {
+          type   = "bind"
+          source = "/var/run/docker.sock"
+          target = "/var/run/docker.sock"
+        }
+      }
+
+      template {
+        data = <<-EOF
+          api:
+            dashboard: true
+            insecure: true
+          
+          entryPoints:
+            web:
+              address: ":80"
+              http:
+                redirections:
+                  entryPoint:
+                    to: websecure
+                    scheme: https
+            websecure:
+              address: ":443"
+          
+          providers:
+            consulCatalog:
+              prefix: traefik
+              exposedByDefault: false
+              endpoint:
+                address: "{{ env "NOMAD_IP_http" }}:8500"
+            file:
+              directory: /etc/traefik/dynamic
+              watch: true
+          
+          certificatesResolvers:
+            letsencrypt:
+              acme:
+                email: jeremy@hobbs.farm
+                storage: /data/acme.json
+                dnsChallenge:
+                  provider: cloudflare
+          
+          ping:
+            entryPoint: api
+          
+          log:
+            level: INFO
+        EOF
+        
+        destination = "local/traefik.yml"
+      }
+
+      resources {
+        cpu    = 200
+        memory = 256
+      }
+
+      volume_mount {
+        volume      = "docker-data"
+        destination = "/data"
+        read_only   = false
+      }
+    }
+
+    volume "docker-data" {
+      type      = "host"
+      source    = "docker-data"
+      read_only = false
+    }
+  }
+}