configurable staging letsencrypt api

roles/traefik/defaults/main.yml

@@ -5,6 +5,7 @@ traefik_websecure_port: 443
 traefik_dashboard_port: 8080
 traefik_metrics_port: 8100
 traefik_dashboard_insecure: true   # ufw should only allow from tailscale or vnet
+traefik_acme_staging: "{{ lookup('env', 'TRAEFIK_ACME_STAGING') | default('false', true) }}"
 
 domain: "{{ lookup('env', 'DOMAIN') | default('', true) }}"
 # Single source of truth for static routing. Expected to be overridden

roles/traefik/templates/dynamic-analytics.yml.j2

@@ -9,6 +9,10 @@ http:
       service: analytics-svc
       tls:
         certResolver: letsencrypt
+        domains:
+          - main: "analytics.{{ env_vars.DOMAIN }}"
+            sans:
+              - "blog.{{ env_vars.DOMAIN }}"
 
   services:
     analytics-svc:

roles/traefik/templates/dynamic-hosts.yml.j2

@@ -9,6 +9,10 @@ http:
         - websecure
       tls:
         certResolver: letsencrypt
+        domains:
+          - main: "app.{{ env_vars.DOMAIN }}"
+            sans:
+              - "blog.{{ env_vars.DOMAIN }}"
 
   services:
     retailor-web-svc:
@@ -17,4 +21,8 @@ http:
 {% for web_ip in env_vars.WEB_IPS | from_json %}
           - url: "http://{{ web_ip }}:80"
 {% endfor %}
+        healthCheck:
+          path: /health
+          interval: "10s"
+          timeout: "3s"
 

roles/traefik/templates/traefik.yml.j2

@@ -27,6 +27,9 @@ certificatesResolvers:
     acme:
       email: "{{ traefik_acme_email }}"
       storage: /etc/traefik/acme.json
+{% if traefik_acme_staging | bool %}
+      caServer: "https://acme-staging-v02.api.letsencrypt.org/directory"
+{% endif %}
       httpChallenge:
         entryPoint: web