Initialise repository structure and placeholder files. Generic functionality works i guess, need to come up with a better solution for compose templates

roles/traefik/README.md

@@ -0,0 +1,7 @@
+# traefik
+
+Deploys Traefik with Docker Compose, a shared proxy network, static config, and
+UFW rules for HTTP and HTTPS.
+
+Tags: `traefik`, `docker`, `config`, `compose`, `firewall`.
+

roles/traefik/defaults/main.yml

@@ -0,0 +1,17 @@
+---
+traefik_dir: /srv/docker/traefik
+traefik_image: traefik:v3.4
+traefik_network: "{{ nbops_proxy_network }}"
+traefik_bind_address: "0.0.0.0"
+traefik_http_port: 80
+traefik_https_port: 443
+traefik_dashboard_enabled: false
+traefik_dashboard_port: 8080
+traefik_acme_email: admin@example.invalid
+traefik_domain: example.invalid
+traefik_env: {}
+traefik_publish_entrypoints: true
+traefik_forwarded_headers_trusted_ips: []
+traefik_tcp_ports:
+  - "{{ traefik_http_port }}"
+  - "{{ traefik_https_port }}"

roles/traefik/files/.gitkeep

@@ -0,0 +1 @@
+

roles/traefik/handlers/main.yml

@@ -0,0 +1,6 @@
+---
+- name: restart traefik
+  community.docker.docker_compose_v2:
+    project_src: "{{ traefik_dir }}"
+    state: restarted
+

roles/traefik/tasks/main.yml

@@ -0,0 +1,63 @@
+---
+- name: Create Traefik directories
+  ansible.builtin.file:
+    path: "{{ item }}"
+    state: directory
+    owner: root
+    group: root
+    mode: "0755"
+  loop:
+    - "{{ traefik_dir }}"
+    - "{{ traefik_dir }}/data"
+  tags: [traefik]
+
+- name: Create proxy network
+  community.docker.docker_network:
+    name: "{{ traefik_network }}"
+    state: present
+  tags: [traefik, docker]
+
+- name: Render Traefik environment
+  ansible.builtin.template:
+    src: env.j2
+    dest: "{{ traefik_dir }}/.env"
+    owner: root
+    group: root
+    mode: "0600"
+  no_log: true
+  tags: [traefik, config]
+
+- name: Render Traefik static config
+  ansible.builtin.template:
+    src: traefik.yml.j2
+    dest: "{{ traefik_dir }}/traefik.yml"
+    owner: root
+    group: root
+    mode: "0644"
+  notify: restart traefik
+  tags: [traefik, config]
+
+- name: Render Traefik Compose file
+  ansible.builtin.template:
+    src: compose.yaml.j2
+    dest: "{{ traefik_dir }}/compose.yaml"
+    owner: root
+    group: root
+    mode: "0644"
+  notify: restart traefik
+  tags: [traefik, compose]
+
+- name: Allow Traefik TCP ports
+  community.general.ufw:
+    rule: allow
+    port: "{{ item }}"
+    proto: tcp
+  loop: "{{ traefik_tcp_ports }}"
+  when: traefik_publish_entrypoints | bool
+  tags: [traefik, firewall]
+
+- name: Start Traefik
+  community.docker.docker_compose_v2:
+    project_src: "{{ traefik_dir }}"
+    state: present
+  tags: [traefik, compose]

roles/traefik/templates/compose.yaml.j2

@@ -0,0 +1,22 @@
+services:
+  traefik:
+    image: {{ traefik_image }}
+    restart: unless-stopped
+    env_file: .env
+{% if traefik_publish_entrypoints %}
+    ports:
+      - "{{ traefik_bind_address }}:{{ traefik_http_port }}:{{ traefik_http_port }}"
+      - "{{ traefik_bind_address }}:{{ traefik_https_port }}:{{ traefik_https_port }}"
+{% if traefik_dashboard_enabled %}
+      - "{{ traefik_bind_address }}:{{ traefik_dashboard_port }}:{{ traefik_dashboard_port }}"
+{% endif %}
+{% endif %}
+    volumes:
+      - /var/run/docker.sock:/var/run/docker.sock:ro
+      - ./traefik.yml:/etc/traefik/traefik.yml:ro
+      - ./data:/data
+    networks:
+      - {{ traefik_network }}
+networks:
+  {{ traefik_network }}:
+    external: true

roles/traefik/templates/env.j2

@@ -0,0 +1,6 @@
+TRAEFIK_DOMAIN={{ traefik_domain }}
+TRAEFIK_ACME_EMAIL={{ traefik_acme_email }}
+{% for key, value in traefik_env.items() %}
+{{ key }}={{ value }}
+{% endfor %}
+

roles/traefik/templates/traefik.yml.j2

@@ -0,0 +1,31 @@
+api:
+  dashboard: {{ traefik_dashboard_enabled | bool | ternary('true', 'false') }}
+entryPoints:
+  web:
+    address: ":{{ traefik_http_port }}"
+{% if traefik_forwarded_headers_trusted_ips | length > 0 %}
+    forwardedHeaders:
+      trustedIPs:
+{% for cidr in traefik_forwarded_headers_trusted_ips %}
+        - "{{ cidr }}"
+{% endfor %}
+{% endif %}
+  websecure:
+    address: ":{{ traefik_https_port }}"
+{% if traefik_forwarded_headers_trusted_ips | length > 0 %}
+    forwardedHeaders:
+      trustedIPs:
+{% for cidr in traefik_forwarded_headers_trusted_ips %}
+        - "{{ cidr }}"
+{% endfor %}
+{% endif %}
+providers:
+  docker:
+    exposedByDefault: false
+certificatesResolvers:
+  letsencrypt:
+    acme:
+      email: "{{ traefik_acme_email }}"
+      storage: /data/acme.json
+      httpChallenge:
+        entryPoint: web