implemented compose by url, parse, local yaml.

roles/traefik/README.md

@@ -3,5 +3,23 @@
 Deploys Traefik with Docker Compose, a shared proxy network, static config, and
 UFW rules for HTTP and HTTPS.
 
-Tags: `traefik`, `docker`, `config`, `compose`, `firewall`.
+Traefik can use the Docker provider for local label-based routing, the file
+provider for central edge-to-internal-Traefik routing, or both:
 
+```yaml
+traefik_docker_provider_enabled: false
+traefik_file_provider_enabled: true
+traefik_dynamic_inventory_group: nbops
+```
+
+When the file provider is enabled, the role renders
+`{{ traefik_dir }}/dynamic/http-services.yml` from `nbops_traefik_file_routes`
+declared in host variables across the inventory group. In the normal multi-VM
+topology those routes point at each downstream VM's internal Traefik entrypoint,
+not directly at application containers.
+
+Routes can set `servers_transport` to reference entries in
+`traefik_dynamic_servers_transports`, which is intended for the future
+edge-to-internal mTLS path.
+
+Tags: `traefik`, `docker`, `config`, `compose`, `firewall`.

roles/traefik/defaults/main.yml

@@ -11,6 +11,12 @@ traefik_acme_email: admin@example.invalid
 traefik_domain: example.invalid
 traefik_env: {}
 traefik_publish_entrypoints: true
+traefik_docker_provider_enabled: true
+traefik_file_provider_enabled: false
+traefik_dynamic_dir: "{{ traefik_dir }}/dynamic"
+traefik_dynamic_config_file: "{{ traefik_dynamic_dir }}/http-services.yml"
+traefik_dynamic_inventory_group: nbops
+traefik_dynamic_servers_transports: []
 traefik_forwarded_headers_trusted_ips: []
 traefik_tcp_ports:
   - "{{ traefik_http_port }}"

roles/traefik/tasks/main.yml

@@ -9,6 +9,7 @@
   loop:
     - "{{ traefik_dir }}"
     - "{{ traefik_dir }}/data"
+    - "{{ traefik_dynamic_dir }}"
   tags: [traefik]
 
 - name: Create proxy network
@@ -17,16 +18,6 @@
     state: present
   tags: [traefik, docker]
 
-- name: Render Traefik environment
-  ansible.builtin.template:
-    src: env.j2
-    dest: "{{ traefik_dir }}/.env"
-    owner: root
-    group: root
-    mode: "0600"
-  no_log: true
-  tags: [traefik, config]
-
 - name: Render Traefik static config
   ansible.builtin.template:
     src: traefik.yml.j2
@@ -37,27 +28,31 @@
   notify: restart traefik
   tags: [traefik, config]
 
-- name: Render Traefik Compose file
+- name: Render Traefik dynamic HTTP config
   ansible.builtin.template:
-    src: compose.yaml.j2
-    dest: "{{ traefik_dir }}/compose.yaml"
+    src: dynamic-http.yml.j2
+    dest: "{{ traefik_dynamic_config_file }}"
     owner: root
     group: root
     mode: "0644"
+  when: traefik_file_provider_enabled | bool
   notify: restart traefik
-  tags: [traefik, compose]
+  tags: [traefik, config]
 
-- name: Allow Traefik TCP ports
-  community.general.ufw:
-    rule: allow
-    port: "{{ item }}"
-    proto: tcp
-  loop: "{{ traefik_tcp_ports }}"
-  when: traefik_publish_entrypoints | bool
-  tags: [traefik, firewall]
-
-- name: Start Traefik
-  community.docker.docker_compose_v2:
-    project_src: "{{ traefik_dir }}"
-    state: present
-  tags: [traefik, compose]
+- name: Deploy Traefik Compose project
+  ansible.builtin.include_role:
+    name: compose_project
+  vars:
+    compose_project_dir: "{{ traefik_dir }}"
+    compose_project_directories:
+      - "{{ traefik_dir }}"
+      - "{{ traefik_dir }}/data"
+      - "{{ traefik_dynamic_dir }}"
+    compose_project_env_template_src: "{{ playbook_dir }}/../roles/traefik/templates/env.j2"
+    compose_project_compose_template_src: "{{ playbook_dir }}/../roles/traefik/templates/compose.yaml.j2"
+    compose_project_override_template_src: "{{ playbook_dir }}/../roles/traefik/templates/compose.override.yaml.j2"
+    compose_project_create_proxy_network: true
+    compose_project_proxy_network: "{{ traefik_network }}"
+    compose_project_firewall_ports: "{{ traefik_tcp_ports }}"
+    compose_project_firewall_enabled: "{{ traefik_publish_entrypoints | bool }}"
+  tags: [traefik]

roles/traefik/templates/compose.override.yaml.j2

@@ -0,0 +1,3 @@
+services:
+  traefik: {}
+

roles/traefik/templates/compose.yaml.j2

@@ -12,8 +12,13 @@ services:
 {% endif %}
 {% endif %}
     volumes:
+{% if traefik_docker_provider_enabled | bool %}
       - /var/run/docker.sock:/var/run/docker.sock:ro
+{% endif %}
       - ./traefik.yml:/etc/traefik/traefik.yml:ro
+{% if traefik_file_provider_enabled | bool %}
+      - ./dynamic:/etc/traefik/dynamic:ro
+{% endif %}
       - ./data:/data
     networks:
       - {{ traefik_network }}

roles/traefik/templates/dynamic-http.yml.j2

@@ -0,0 +1,81 @@
+{% set ns = namespace(route_count=0) %}
+{% for host in groups[traefik_dynamic_inventory_group] | default([]) %}
+{% set ns.route_count = ns.route_count + (hostvars[host].nbops_traefik_file_routes | default([]) | length) %}
+{% endfor %}
+{% if ns.route_count == 0 %}
+http:
+  routers: {}
+  services: {}
+{% else %}
+http:
+  routers:
+{% for host in groups[traefik_dynamic_inventory_group] | default([]) %}
+{% for route in hostvars[host].nbops_traefik_file_routes | default([]) %}
+    {{ route.name }}:
+{% if route.rule is defined %}
+      rule: "{{ route.rule }}"
+{% else %}
+      rule: "Host(`{{ route.domain | default(route.name ~ '.' ~ nbops_service_domain_suffix) }}`)"
+{% endif %}
+      entryPoints:
+        - {{ route.entrypoint | default(nbops_traefik_entrypoint) }}
+{% if route.middlewares | default([]) | length > 0 %}
+      middlewares:
+{% for middleware in route.middlewares %}
+        - {{ middleware }}
+{% endfor %}
+{% endif %}
+      service: {{ route.service | default(route.name) }}
+{% if route.tls | default(nbops_traefik_tls) | bool %}
+      tls:
+        certResolver: {{ route.cert_resolver | default('letsencrypt') }}
+{% endif %}
+{% endfor %}
+{% endfor %}
+  services:
+{% for host in groups[traefik_dynamic_inventory_group] | default([]) %}
+{% for route in hostvars[host].nbops_traefik_file_routes | default([]) %}
+    {{ route.service | default(route.name) }}:
+      loadBalancer:
+        servers:
+{% if route.url is defined %}
+          - url: "{{ route.url }}"
+{% else %}
+          - url: "{{ route.scheme | default('http') }}://{{ route.target_host | default(hostvars[host].ansible_host | default(host)) }}:{{ route.port | default(route.service_port | default(route.target_port | default(80))) }}"
+{% endif %}
+{% if route.pass_host_header | default(true) | bool %}
+        passHostHeader: true
+{% else %}
+        passHostHeader: false
+{% endif %}
+{% if route.servers_transport is defined %}
+        serversTransport: {{ route.servers_transport }}
+{% endif %}
+{% endfor %}
+{% endfor %}
+{% if traefik_dynamic_servers_transports | length > 0 %}
+  serversTransports:
+{% for transport in traefik_dynamic_servers_transports %}
+    {{ transport.name }}:
+{% if transport.server_name is defined %}
+      serverName: "{{ transport.server_name }}"
+{% endif %}
+{% if transport.insecure_skip_verify | default(false) | bool %}
+      insecureSkipVerify: true
+{% endif %}
+{% if transport.root_cas | default([]) | length > 0 %}
+      rootCAs:
+{% for ca in transport.root_cas %}
+        - {{ ca }}
+{% endfor %}
+{% endif %}
+{% if transport.certificates | default([]) | length > 0 %}
+      certificates:
+{% for certificate in transport.certificates %}
+        - certFile: {{ certificate.cert_file }}
+          keyFile: {{ certificate.key_file }}
+{% endfor %}
+{% endif %}
+{% endfor %}
+{% endif %}
+{% endif %}

roles/traefik/templates/traefik.yml.j2

@@ -20,8 +20,15 @@ entryPoints:
 {% endfor %}
 {% endif %}
 providers:
+{% if traefik_docker_provider_enabled | bool %}
   docker:
     exposedByDefault: false
+{% endif %}
+{% if traefik_file_provider_enabled | bool %}
+  file:
+    directory: /etc/traefik/dynamic
+    watch: true
+{% endif %}
 certificatesResolvers:
   letsencrypt:
     acme:

roles/traefik/upstream/SOURCE.md

@@ -0,0 +1,7 @@
+# Upstream Snapshot
+
+This directory stores copied upstream reference files for the `traefik` role.
+
+See `docs/upstream-sources.yml` for repository URLs, refs, README paths, Compose paths, and verification status.
+
+Snapshot files are reference material only. Deployments are generated from this role's `templates/` directory.