dns ratelimit

plays/traefik.yml

@@ -4,5 +4,4 @@
   roles:
     - role: roles/firewall
     - role: roles/docker
-    - role: roles/env
     - role: roles/traefik

roles/traefik/defaults/main.yml

@@ -4,12 +4,15 @@ traefik_web_port: 80
 traefik_websecure_port: 443
 traefik_dashboard_port: 8080
 traefik_metrics_port: 8100
+
+traefik_image: "traefik:v3.1"
 traefik_dashboard_insecure: true   # ufw should only allow from tailscale or vnet
 traefik_acme_staging: "{{ lookup('env', 'TRAEFIK_ACME_STAGING') | default('false', true) }}"
 
-domain: "{{ lookup('env', 'DOMAIN') | default('', true) }}"
+traefik_acme_email: "{{ lookup('env', 'TRAEFIK_ACME_EMAIL') | default('', true) }}"
+traefik_domain: "{{ lookup('env', 'DOMAIN') | default('', true) }}"
 # Single source of truth for static routing. Expected to be overridden
 # from group_vars, -e, or an env-var lookup at the play level — see
 # playbook.yml for the TRAEFIK_ROUTES example.
-traefik_web_private_ips: "{{ lookup('env', 'WEB_IPS') | default('[]', true) | from_json }}"
+traefik_web_private_ips: "{{ lookup('env', 'WEB_IPS') | from_json }}"
 traefik_analytics_private_ip: "{{ lookup('env', 'ANALYTICS_IP') | default('', true) }}"

roles/traefik/tasks/install.yml

@@ -5,7 +5,7 @@
       traefik_web_private_ips is empty. Set the WEB_IPS env var
       (JSON list) before running, or override the variable directly, e.g.
       -e traefik_web_private_ips='["10.0.1.11","10.0.1.12"]'
-  when: env_vars.WEB_IPS | length == 0
+  when: traefik_web_private_ips | length == 0
 
 - name: Ensure Traefik config directories exist
   ansible.builtin.file:

roles/traefik/templates/dynamic-analytics.yml.j2

@@ -3,22 +3,22 @@
 http:
   routers:
     analytics:
-      rule: "Host(`analytics.{{ env_vars.DOMAIN }}`)"
+      rule: "Host(`analytics.{{ traefik_domain }}`)"
       entryPoints:
         - websecure
       service: analytics-svc
       tls:
         certResolver: letsencrypt
         domains:
-          - main: "analytics.{{ env_vars.DOMAIN }}"
+          - main: "analytics.{{ traefik_domain }}"
             sans:
-              - "blog.{{ env_vars.DOMAIN }}"
+              - "blog-1.{{ traefik_domain }}"
 
   services:
     analytics-svc:
       loadBalancer:
         servers:
-          - url: "http://{{ env_vars.ANALYTICS_IP }}:3000"
+          - url: "http://{{ traefik_analytics_private_ip }}:3000"
         healthCheck:
           path: /api/heartbeat
           interval: "10s"

roles/traefik/templates/dynamic-hosts.yml.j2

@@ -3,22 +3,22 @@
 http:
   routers:
     retailor-web:
-      rule: "Host(`app.{{ env_vars.DOMAIN }}`)"
+      rule: "Host(`app.{{ traefik_domain }}`)"
       service: retailor-web-svc
       entryPoints:
         - websecure
       tls:
         certResolver: letsencrypt
         domains:
-          - main: "app.{{ env_vars.DOMAIN }}"
+          - main: "app.{{ traefik_domain }}"
             sans:
-              - "blog.{{ env_vars.DOMAIN }}"
+              - "blog-1.{{ traefik_domain }}"
 
   services:
     retailor-web-svc:
       loadBalancer:
         servers:
-{% for web_ip in env_vars.WEB_IPS | from_json %}
+{% for web_ip in traefik_web_private_ips %}
           - url: "http://{{ web_ip }}:80"
 {% endfor %}
         healthCheck: