chef-recipes/containers/traefik/tasks.yml

# code: language=ansible

---
- hosts: all
  name: Traefik reverse proxy
  tasks:
    - name: Get containers UID
      ansible.builtin.command: "id -u containers"
      register: uid_containers
      changed_when: uid_containers.rc != 0

    - name: Stop running containers
      become_user: containers
      become: true
      ansible.builtin.systemd:
        scope: user
        name: container-{{ item }}.service
        state: stopped
      loop:
        - traefik
      failed_when: false

    - name: Permit traffic from any IP to http port
      become: true
      community.general.ufw:
        direction: in
        from_ip: any
        proto: tcp
        to_port: 80
        rule: allow

    - name: Permit traffic from any IP to https port
      become: true
      community.general.ufw:
        direction: in
        from_ip: any
        proto: tcp
        to_port: 443
        rule: allow

    - name: Permit traffic from any IP to mattermost port
      become: true
      community.general.ufw:
        direction: in
        from_ip: any
        proto: udp
        to_port: 8443
        rule: allow

    - name: Pull traefik image
      become_user: containers
      become: true
      containers.podman.podman_image:
        name: docker.io/traefik:latest

    - name: Change permission to traefik folder
      become: true
      ansible.builtin.file:
        path: /etc/traefik
        owner: containers
        group: containers
        mode: "0700"
        state: directory

    - name: Copy config directory
      become: true
      ansible.builtin.copy:
        src: files/
        dest: /etc/traefik/
        owner: containers
        group: containers
        mode: "0600"

    - name: Copy config files from templates
      become: true
      ansible.builtin.template:
        src: "templates/{{ item }}.j2"
        dest: "/etc/traefik/{{ item }}"
        owner: containers
        group: containers
        mode: "0600"
      loop:
        - traefik.yml
        - conf/cockpit.yml

    - name: Create podman networks
      containers.podman.podman_network:
        name: "{{ item }}"
        recreate: false
        state: "present"
      become_user: containers
      become: true
      loop:
        - traefik
        - traefik-portainer
        - traefik-nextcloud
        - traefik-gitea
        - traefik-collabora
        - traefik-heimdall
        - traefik-mattermost

    - name: Create traefik instance
      become_user: containers
      become: true
      containers.podman.podman_container:
        name: traefik
        image: docker.io/traefik:latest
        state: present
        publish:
          - "80:80"
          - "443:443"
          - "8443:8443"
        security_opt:
          - label=type:container_runtime_t
        volume:
          - /run/user/{{ uid_containers.stdout }}/podman/podman.sock:/var/run/docker.sock:z
          - /etc/traefik/:/etc/traefik:Z
        network:
          - traefik
          - traefik-portainer
          - traefik-nextcloud
          - traefik-gitea
          - traefik-collabora
          - traefik-heimdall
          - traefik-mattermost
        cap_add:
          - NET_ADMIN
        label:
          io.containers.autoupdate: "registry"
          traefik.enable: "true"
          traefik.http.middlewares.traefik-auth.basicauth.users: "{{ vault_traefik_basic_auth }}"
          traefik.http.routers.traefik.entrypoints: "https"
          traefik.http.routers.traefik.rule: "Host(`{{ vault_domain }}`) && (PathPrefix(`/api/`) || Path(`/api`) || PathPrefix(`/dashboard/`) || Path(`/dashboard`))"
          traefik.http.routers.traefik.middlewares: "traefik-auth@docker"
          traefik.http.routers.traefik.tls: "true"
          traefik.http.routers.traefik.tls.certresolver: "wildcard"
          traefik.http.routers.traefik.tls.domains[0].main: "{{ inventory_hostname }}"
          traefik.http.routers.traefik.service: "api@internal"
        generate_systemd:
          path: /home/containers/.config/systemd/user/
          restart_policy: on-failure
          names: true
          new: true

    - name: Change start and stop timeout limits
      become_user: containers
      become: true
      community.general.ini_file:
        path: /home/containers/.config/systemd/user/container-traefik.service
        section: Service
        option: "{{ item }}"
        value: 3600
        mode: "0664"
        state: "present"
        no_extra_spaces: true
      loop:
        - TimeoutStartSec
        - TimeoutStopSec

    - name: Start containers at boot
      become_user: containers
      become: true
      ansible.builtin.systemd:
        scope: user
        name: container-{{ item }}.service
        enabled: true
        state: started
        daemon_reload: true
      loop:
        - traefik