ansible

ansible/roles/traefik/handlers/main.yaml

@@ -0,0 +1,5 @@
+---
+- name: Restart Traefik
+  community.docker.docker_compose_v2:
+    project_src: /opt/traefik
+    state: restarted

ansible/roles/traefik/tasks/main.yaml

@@ -0,0 +1,53 @@
+---
+- name: Create Traefik directories
+  file:
+    path: "{{ item }}"
+    state: directory
+    mode: '0755'
+  loop:
+    - /opt/traefik
+    - /opt/traefik/config
+    - /opt/traefik/letsencrypt
+    - /opt/traefik/logs
+
+- name: Create Traefik Docker network
+  community.docker.docker_network:
+    name: "{{ traefik_network }}"
+    driver: bridge
+    state: present
+
+- name: Deploy Traefik static configuration
+  template:
+    src: traefik.yml.j2
+    dest: /opt/traefik/traefik.yml
+    mode: '0644'
+  notify: Restart Traefik
+
+- name: Deploy Traefik dynamic configuration
+  template:
+    src: dynamic.yml.j2
+    dest: /opt/traefik/config/dynamic.yml
+    mode: '0644'
+  notify: Restart Traefik
+
+- name: Deploy Traefik docker-compose
+  template:
+    src: docker-compose.yml.j2
+    dest: /opt/traefik/docker-compose.yml
+    mode: '0644'
+  notify: Restart Traefik
+
+- name: Start Traefik
+  community.docker.docker_compose_v2:
+    project_src: /opt/traefik
+    state: present
+  register: traefik_output
+
+- name: Wait for Traefik to be healthy
+  uri:
+    url: http://localhost:8080/ping
+    status_code: 200
+  retries: 10
+  delay: 3
+  register: result
+  until: result.status == 200

ansible/roles/traefik/templates/docker-compose.yml.j2

@@ -0,0 +1,26 @@
+services:
+  traefik:
+    image: traefik:v3.2
+    container_name: traefik
+    restart: unless-stopped
+    security_opt:
+      - no-new-privileges:true
+    networks:
+      - {{ traefik_network }}
+    ports:
+      - "80:80"
+      - "443:443"
+      - "10.20.0.10:8080:8080"  # Dashboard only on WireGuard IP
+    environment:
+      - TZ=UTC
+    volumes:
+      - /etc/localtime:/etc/localtime:ro
+      - /var/run/docker.sock:/var/run/docker.sock:ro
+      - ./traefik.yml:/traefik.yml:ro
+      - ./config:/config:ro
+      - ./letsencrypt:/letsencrypt
+      - ./logs:/var/log/traefik
+
+networks:
+  {{ traefik_network }}:
+    external: true

ansible/roles/traefik/templates/dynamic.yml.j2

@@ -0,0 +1,17 @@
+http:
+  middlewares:
+    # Security headers
+    secure-headers:
+      headers:
+        sslRedirect: true
+        forceSTSHeader: true
+        stsIncludeSubdomains: true
+        stsPreload: true
+        stsSeconds: 31536000
+
+    # Rate limiting
+    rate-limit:
+      rateLimit:
+        average: 100
+        burst: 50
+        period: 1s

ansible/roles/traefik/templates/traefik.yml.j2

@@ -0,0 +1,40 @@
+api:
+  dashboard: true
+  insecure: true  # Dashboard on port 8080 (bound to WireGuard IP only)
+
+entryPoints:
+  web:
+    address: ":80"
+    http:
+      redirections:
+        entryPoint:
+          to: websecure
+          scheme: https
+          permanent: true
+  websecure:
+    address: ":443"
+
+providers:
+  docker:
+    endpoint: "unix:///var/run/docker.sock"
+    exposedByDefault: false
+    network: {{ traefik_network }}
+  file:
+    directory: /config
+    watch: true
+
+certificatesResolvers:
+  letsencrypt:
+    acme:
+      email: {{ letsencrypt_email | default('admin@asxp.io') }}
+      storage: /letsencrypt/acme.json
+      httpChallenge:
+        entryPoint: web
+
+log:
+  level: INFO
+  filePath: /var/log/traefik/traefik.log
+
+accessLog:
+  filePath: /var/log/traefik/access.log
+  bufferingSize: 100