mgmt/backups/nomad-jobs-20251004-074411/components/traefik/jobs/traefik-cloudflare.nomad

job "traefik-cloudflare-v1" {
  datacenters = ["dc1"]
  type = "service"

  group "traefik" {
    count = 1

    constraint {
      attribute = "${node.unique.name}"
      value     = "hcp1"
    }


    network {
      mode = "host"
      port "http" {
        static = 80
        host_network = "tailscale0"
      }
      port "https" {
        static = 443
        host_network = "tailscale0"
      }
      port "traefik" {
        static = 8080
        host_network = "tailscale0"
      }
    }

    task "traefik" {
      driver = "exec"
      
             config {
               command = "/usr/local/bin/traefik"
               args = [
                 "--configfile=/local/traefik.yml"
               ]
             }

      template {
        data = <<EOF
api:
  dashboard: true
  insecure: true

entryPoints:
  web:
    address: "0.0.0.0:80"
    http:
      redirections:
        entrypoint:
          to: websecure
          scheme: https
          permanent: true
  websecure:
    address: "0.0.0.0:443"
  traefik:
    address: "0.0.0.0:8080"

providers:
  consulCatalog:
    endpoint:
      address: "warden.tailnet-68f9.ts.net:8500"
      scheme: "http"
    watch: true
    exposedByDefault: false
    prefix: "traefik"
    defaultRule: "Host(`{{ .Name }}.git4ta.me`)"
  file:
    filename: /local/dynamic.yml
    watch: true

certificatesResolvers:
  cloudflare:
    acme:
      email: houzhongxu.houzhongxu@gmail.com
      storage: /local/acme.json
      dnsChallenge:
        provider: cloudflare
        delayBeforeCheck: 30s
        resolvers:
          - "1.1.1.1:53"
          - "1.0.0.1:53"

log:
  level: DEBUG
EOF
        destination = "local/traefik.yml"
      }

      template {
        data = <<EOF
http:
  serversTransports:
    waypoint-insecure:
      insecureSkipVerify: true
  
  middlewares:
    consul-stripprefix:
      stripPrefix:
        prefixes:
          - "/consul"
    waypoint-auth:
      replacePathRegex:
        regex: "^/auth/token(.*)$"
        replacement: "/auth/token$1"

  services:
    consul-cluster:
      loadBalancer:
        servers:
          - url: "http://warden.tailnet-68f9.ts.net:8500"  # 北京，优先
          - url: "http://ch4.tailnet-68f9.ts.net:8500"     # 韩国，备用
          - url: "http://ash3c.tailnet-68f9.ts.net:8500"   # 美国，备用
        healthCheck:
          path: "/v1/status/leader"
          interval: "30s"
          timeout: "15s"

    nomad-cluster:
      loadBalancer:
        servers:
          - url: "http://warden.tailnet-68f9.ts.net:4646"  # 北京，优先
          - url: "http://ch4.tailnet-68f9.ts.net:4646"     # 韩国，备用
          - url: "http://ash3c.tailnet-68f9.ts.net:4646"   # 美国，备用
        healthCheck:
          path: "/v1/status/leader"
          interval: "30s"
          timeout: "15s"

    waypoint-cluster:
      loadBalancer:
        servers:
          - url: "https://hcp1.tailnet-68f9.ts.net:9701"  # hcp1 节点 HTTPS API
        serversTransport: waypoint-insecure

    vault-cluster:
      loadBalancer:
        servers:
          - url: "http://ch4.tailnet-68f9.ts.net:8200"     # 韩国，活跃节点
          - url: "http://ash3c.tailnet-68f9.ts.net:8200"   # 美国，备用节点
          - url: "http://warden.tailnet-68f9.ts.net:8200"  # 北京，备用节点
        healthCheck:
          path: "/v1/sys/health"
          interval: "30s"
          timeout: "15s"

  routers:
    consul-api:
      rule: "Host(`consul.git4ta.me`)"
      service: consul-cluster
      middlewares:
        - consul-stripprefix
      entryPoints:
        - websecure
      tls:
        certResolver: cloudflare
    
    traefik-dashboard:
      rule: "Host(`traefik.git4ta.me`)"
      service: dashboard@internal
      middlewares:
        - dashboard_redirect@internal
        - dashboard_stripprefix@internal
      entryPoints:
        - websecure
      tls:
        certResolver: cloudflare

    nomad-ui:
      rule: "Host(`nomad.git4ta.me`)"
      service: nomad-cluster
      entryPoints:
        - websecure
      tls:
        certResolver: cloudflare

    waypoint-ui:
      rule: "Host(`waypoint.git4ta.me`)"
      service: waypoint-cluster
      entryPoints:
        - websecure
      tls:
        certResolver: cloudflare

    vault-ui:
      rule: "Host(`vault.git4ta.me`)"
      service: vault-cluster
      entryPoints:
        - websecure
      tls:
        certResolver: cloudflare
EOF
        destination = "local/dynamic.yml"
      }

      template {
        data = <<EOF
CLOUDFLARE_EMAIL=houzhongxu.houzhongxu@gmail.com
CLOUDFLARE_DNS_API_TOKEN=HYT-cfZTP_jq6Xd9g3tpFMwxopOyIrf8LZpmGAI3
CLOUDFLARE_ZONE_API_TOKEN=HYT-cfZTP_jq6Xd9g3tpFMwxopOyIrf8LZpmGAI3
EOF
        destination = "local/cloudflare.env"
        env = true
      }

      resources {
        cpu = 500
        memory = 512
      }
    }
  }
}