---

# Instance (if several instances run on the same namespace)
instance: traefik

traefik:

  # Docker image to use for Traefik
  image: '[[ .docker.repo ]]traefik:3.0.0-beta5-1'

  # Resources for traefik instances
  resources:
    cpu: 500
    memory: 256

  # Number of traefik instances
  count: 2

  # Set a high priority for the job
  nomad:
    priority: 100

  api:
    traefik:
      entrypoints:
        - https
      # List of Traefik middlewares to be applied on the API / dashboard
      middlewares:
        - ip-trusted@file
        - csp-strict@file

  ping:
    traefik:
      entrypoints:
        - http
        - https
      priority: 2000
      # List of Traefik middlewares for the /ping endpoint
      middlewares: []

  # List of trusted proxies from whom to trust proxy protocol v1/v2 source address
  trusted_proxies: []

  # List entrypoints to configure. Note that if prometheus is enabled, another entrypoint named metrics will bind on 127.0.0.1:9500
  # entrypoints:
  #   postgres:
  #     static: 5432
  #     to: 5432
  #     protocol: tcp
  #     middlewares:
  #       - ip-trusted@file
  #   syslog:
  #     static: 514
  #     to: 5514
  #     protocol: udp
  entrypoints:
    http:
      static: 80
      to: 5080
      http:
        redirections:
          entryPoint:
            to: :{{ env "NOMAD_HOST_PORT_https" }}
            priority: 1000
    https:
      static: 443
      to: 5443
      http:
        tls: {}

  # The public URL, on which the following endpoints will be exposed
  # - /api : the API
  # - /ping : the health check
  # Note : this URL should have a path (so https://traefik.example.org/ is invalid but https://traefik/example.org/dashboard is valid)
  public_url: https://traefik.example.org/dashboard

  # Prometheus settings
  prometheus:
    # The metrics_url should point on the metrics endpoint from the container's POV
    # It'll be used to exposed metrics using a nginx proxy (adding mTLS)
    metrics_url: http://localhost:9500/metrics

lemonldap:
  # If enabled, will run a Lemonldap::NG handler sidecar
  # able to auth using the lemonldap@file middleware
  enabled: False

  # Docker image to use for Lemonldap::NG handler
  image: '[[ .docker.repo ]]lemonldap-ng:latest'

  # Resources for Lemonldap::NG handlers
  resources:
    cpu: 200
    memory: 128

  config:
    url: https://auth.example.org/index.psgi/config
    # user: lemonldap
    # password: secret
    realm: Lemonldap::NG API

  sessions:
    url: https://auth.example.org/index.psgi/sessions/global
    # user: lemonldap
    # password: secret
    realm: Lemonldap::NG API