updated ansible for lightning-lane

ansible/roles/traefik/templates/compose.yml.j2

@@ -0,0 +1,36 @@
+# ------------------------------------------------------------------------------
+# Traefik Docker Compose
+# Managed by Ansible — do not edit manually
+# ------------------------------------------------------------------------------
+
+services:
+  traefik:
+    image: traefik:{{ traefik_version }}
+    container_name: traefik
+    restart: unless-stopped
+    security_opt:
+      - no-new-privileges:true
+    ports:
+      - "{{ traefik_http_port }}:80"
+      - "{{ traefik_https_port }}:443"
+{% if traefik_dashboard_enabled %}
+      - "{{ traefik_dashboard_port }}:8080"
+{% endif %}
+    env_file:
+      - .env
+    volumes:
+      - /var/run/docker.sock:/var/run/docker.sock:ro
+      - {{ traefik_config_dir }}/traefik.yml:/etc/traefik/traefik.yml:ro
+      - {{ traefik_config_dir }}/dynamic:/etc/traefik/dynamic:ro
+      - {{ traefik_certs_dir }}/acme.json:/certs/acme.json
+{% if traefik_accesslog_enabled %}
+      - {{ traefik_logs_dir }}:/logs
+{% endif %}
+    networks:
+      - {{ traefik_network }}
+    labels:
+      - "traefik.enable=true"
+
+networks:
+  {{ traefik_network }}:
+    external: true

ansible/roles/traefik/templates/dynamic.yml.j2

@@ -0,0 +1,34 @@
+# ------------------------------------------------------------------------------
+# Traefik Dynamic Configuration
+# Managed by Ansible — do not edit manually
+# ------------------------------------------------------------------------------
+
+http:
+{% if traefik_security_headers %}
+  middlewares:
+    security-headers:
+      headers:
+        browserXssFilter: true
+        contentTypeNosniff: true
+        frameDeny: true
+        stsIncludeSubdomains: true
+        stsPreload: true
+        stsSeconds: 31536000
+        customFrameOptionsValue: "SAMEORIGIN"
+        customResponseHeaders:
+          X-Robots-Tag: "noindex,nofollow,nosnippet,noarchive,notranslate,noimageindex"
+          server: ""
+          X-Forwarded-Proto: "https"
+{% endif %}
+
+tls:
+  options:
+    default:
+      minVersion: VersionTLS12
+      cipherSuites:
+        - TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
+        - TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
+        - TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305
+        - TLS_AES_128_GCM_SHA256
+        - TLS_AES_256_GCM_SHA384
+        - TLS_CHACHA20_POLY1305_SHA256

ansible/roles/traefik/templates/env.j2

@@ -0,0 +1,2 @@
+# Managed by Ansible — do not edit manually
+CF_DNS_API_TOKEN={{ traefik_cloudflare_api_token }}

ansible/roles/traefik/templates/traefik.yml.j2

@@ -0,0 +1,68 @@
+# ------------------------------------------------------------------------------
+# Traefik Static Configuration
+# Managed by Ansible — do not edit manually
+# ------------------------------------------------------------------------------
+
+api:
+  dashboard: {{ traefik_dashboard_enabled | lower }}
+  insecure: {{ traefik_dashboard_enabled | lower }}
+
+entryPoints:
+  web:
+    address: ":{{ traefik_http_port }}"
+{% if traefik_tls_enabled and traefik_tls_redirect %}
+    http:
+      redirections:
+        entryPoint:
+          to: websecure
+          scheme: https
+{% endif %}
+
+  websecure:
+    address: ":{{ traefik_https_port }}"
+{% if traefik_tls_enabled %}
+    http:
+      tls:
+        certResolver: {{ traefik_tls_certresolver }}
+        domains:
+          - main: "{{ traefik_domain }}"
+            sans:
+              - "*.{{ traefik_domain }}"
+{% endif %}
+
+providers:
+  docker:
+    endpoint: "unix:///var/run/docker.sock"
+    exposedByDefault: false
+    network: {{ traefik_network }}
+  file:
+    directory: /etc/traefik/dynamic
+    watch: true
+
+{% if traefik_tls_enabled %}
+certificatesResolvers:
+  {{ traefik_tls_certresolver }}:
+    acme:
+      email: "{{ traefik_tls_acme_email }}"
+      storage: /certs/acme.json
+      dnsChallenge:
+        provider: {{ traefik_tls_certresolver }}
+        resolvers:
+          - "1.1.1.1:53"
+          - "8.8.8.8:53"
+{% endif %}
+
+{% if traefik_accesslog_enabled %}
+accessLog:
+  filePath: /logs/access.log
+{% endif %}
+
+{% if traefik_prometheus_enabled %}
+metrics:
+  prometheus:
+    addEntryPointsLabels: true
+    addServicesLabels: true
+{% endif %}
+
+log:
+  level: INFO