play for installing traefik on lb servers

roles/traefik/templates/dynamic-analytics.yml.j2

@@ -0,0 +1,21 @@
+## Managed by Ansible — do not edit by hand.
+## Source: traefik_analytics_private_ip (group_vars/lb.yml)
+http:
+  routers:
+    analytics:
+      rule: "Host(`analytics.{{ env_vars.DOMAIN }}`)"
+      entryPoints:
+        - websecure
+      service: analytics-svc
+      tls:
+        certResolver: letsencrypt
+
+  services:
+    analytics-svc:
+      loadBalancer:
+        servers:
+          - url: "http://{{ env_vars.ANALYTICS_IP }}:3000"
+        healthCheck:
+          path: /api/heartbeat
+          interval: "10s"
+          timeout: "3s"

roles/traefik/templates/dynamic-hosts.yml.j2

@@ -0,0 +1,20 @@
+## Managed by Ansible — do not edit by hand.
+## Source: traefik_web_private_ips (group_vars/lb.yml)
+http:
+  routers:
+    retailor-web:
+      rule: "Host(`app.{{ env_vars.DOMAIN }}`)"
+      service: retailor-web-svc
+      entryPoints:
+        - websecure
+      tls:
+        certResolver: letsencrypt
+
+  services:
+    retailor-web-svc:
+      loadBalancer:
+        servers:
+{% for web_ip in env_vars.WEB_IPS %}
+          - url: "http://{{ web_ip }}:80"
+{% endfor %}
+

roles/traefik/templates/traefik.service.j2

@@ -0,0 +1,28 @@
+[Unit]
+Description=Traefik reverse proxy
+After=docker.service network-online.target
+Requires=docker.service
+Wants=network-online.target
+
+[Service]
+TimeoutStartSec=0
+Restart=always
+RestartSec=5
+
+# Clean up any stale container from a previous run/crash
+ExecStartPre=-/usr/bin/docker rm -f traefik
+
+ExecStart=/usr/bin/docker run --rm \
+  --name traefik \
+  --network host \
+  --security-opt no-new-privileges:true \
+  -v /var/run/docker.sock:/var/run/docker.sock:ro \
+  -v {{ traefik_config_dir }}/traefik.yml:/etc/traefik/traefik.yml:ro \
+  -v {{ traefik_dynamic_dir }}:/etc/traefik/dynamic:ro \
+  -v {{ traefik_config_dir }}/acme.json:/etc/traefik/acme.json \
+  {{ traefik_image }}
+
+ExecStop=/usr/bin/docker stop traefik
+
+[Install]
+WantedBy=multi-user.target

roles/traefik/templates/traefik.yml.j2

@@ -0,0 +1,38 @@
+entryPoints:
+  web:
+    address: ":{{ traefik_web_port }}"
+  websecure:
+    address: ":{{ traefik_websecure_port }}"
+  traefik:
+    address: ":{{ traefik_dashboard_port }}"
+  metrics:
+    address: ":{{ traefik_metrics_port }}"
+
+providers:
+  file:
+    directory: "{{ traefik_dynamic_dir }}"
+    watch: true
+
+api:
+  dashboard: true
+  insecure: {{ traefik_dashboard_insecure | lower }}
+
+log:
+  level: INFO
+
+accessLog: {}
+
+certificatesResolvers:
+  letsencrypt:
+    acme:
+      email: "{{ traefik_acme_email }}"
+      storage: /etc/traefik/acme.json
+      httpChallenge:
+        entryPoint: web
+
+metrics:
+  prometheus:
+    entryPoint: metrics
+    addEntryPointsLabels: true
+    addServicesLabels: true
+    addRoutersLabels: true