job "traefik" {
  datacenters = ["hf-dc1"]
  type        = "service"
  
  # Run on primary node
  constraint {
    attribute = "${node.class}"
    value     = "primary"
  }

  group "traefik" {
    count = 1

    network {
      port "http" {
        static = 80
      }
      port "https" {
        static = 443
      }
      port "api" {
        static = 8080
      }
    }

    service {
      name = "traefik"
      port = "https"
      
      tags = [
        "traefik.enable=true",
        "traefik.http.routers.api.rule=Host(`traefik.hobbs.farm`)",
        "traefik.http.routers.api.service=api@internal",
      ]

      check {
        type     = "http"
        path     = "/ping"
        port     = "api"
        interval = "10s"
        timeout  = "2s"
      }
    }

    task "traefik" {
      driver = "docker"

      config {
        image = "traefik:v3.0"
        
        ports = ["http", "https", "api"]
        
        volumes = [
          "local/traefik.yml:/etc/traefik/traefik.yml:ro",
          "local/dynamic:/etc/traefik/dynamic:ro",
        ]
        
        # Mount Docker socket for provider
        mount {
          type   = "bind"
          source = "/var/run/docker.sock"
          target = "/var/run/docker.sock"
        }
      }

      template {
        data = <<-EOF
          api:
            dashboard: true
            insecure: true
          
          entryPoints:
            web:
              address: ":80"
              http:
                redirections:
                  entryPoint:
                    to: websecure
                    scheme: https
            websecure:
              address: ":443"
          
          providers:
            consulCatalog:
              prefix: traefik
              exposedByDefault: false
              endpoint:
                address: "{{ env "NOMAD_IP_http" }}:8500"
            file:
              directory: /etc/traefik/dynamic
              watch: true
          
          certificatesResolvers:
            letsencrypt:
              acme:
                email: jeremy@hobbs.farm
                storage: /data/acme.json
                dnsChallenge:
                  provider: cloudflare
          
          ping:
            entryPoint: api
          
          log:
            level: INFO
        EOF
        
        destination = "local/traefik.yml"
      }

      resources {
        cpu    = 200
        memory = 256
      }

      volume_mount {
        volume      = "docker-data"
        destination = "/data"
        read_only   = false
      }
    }

    volume "docker-data" {
      type      = "host"
      source    = "docker-data"
      read_only = false
    }
  }
}