egress-gateway/egress-gateway.nomad.hcl

job "egress-gateway" {

[[ template "common/job_start.tpl" .nomad ]]

  group "egress-gateway" {

    network {
      mode = "bridge"
    }

    # Terminating gateway definition
    service {
      name = "egress-gateway[[ .env.suffix ]]"
      connect {
        gateway {
          proxy {}
          terminating {
          [[- range $service, $def := .egress_gw.services ]]
            service {
              name    = [[ $service | toJSON ]]
            [[- range $k, $v := $def ]]
              [[ $k ]] = [[ $v | toJSON ]]
            [[- end ]]
            }
          [[- end ]]
          }
        }
        sidecar_task {
          config {
            # Access the CA certificate
            volumes = ["../alloc/data:/data"]
          }
          [[ template "common/resources.tpl" .envoy ]]
        }
      }
    }

    # Dummy task to configure custom CA certificates
    # Needed because template is not supported in sidecar_task
    task "ca-certs" {
      driver = "exec"

      config {
        command = "/bin/true"
      }

      # The task will just quit immediatly, mark it as a prestart hook
      lifecycle {
        hook = "prestart"
      }
[[- range $k, $v := .egress_gw.ca_certs ]]

      template {
        data        =<<_EOF
[[ $v ]]
_EOF
        destination = "${NOMAD_ALLOC_DIR}/data/[[ $k ]].crt"
      }
[[- end ]]

      # Give just enough resources
      resources {
        cpu        = 10
        memory     = 10
        memory_max = 20
      }
    }
  }
}

# vim: syntax=hcl