updated ansible

ansible/roles/traefik/defaults/main.yml

@@ -3,39 +3,8 @@
 # FILE: roles/traefik/defaults/main.yml
 # ------------------------------------------------------------------------------
 
-# Traefik version (matches boilerplate)
-traefik_version: "v3.6.8"
-
-# Directory structure on the host
+# Directory on the host where Traefik files are deployed
 traefik_base_dir: /opt/docker/traefik
-traefik_config_dir: "{{ traefik_base_dir }}/config"
-traefik_certs_dir: "{{ traefik_base_dir }}/certs"
-traefik_logs_dir: "{{ traefik_base_dir }}/logs"
 
-# Network
-traefik_network: proxy
-traefik_http_port: 80
-traefik_https_port: 443
-traefik_dashboard_port: 8080
-traefik_dashboard_enabled: true
-
-# TLS / ACME
-traefik_tls_enabled: true
-traefik_tls_certresolver: cloudflare
-traefik_tls_acme_email: ""  # Set in vault
-traefik_tls_redirect: true
-
-# Domain
-traefik_domain: "local.mk-labs.cloud"
-
-# Cloudflare API token — set in vault
+# Cloudflare API token — MUST be set in vault
 traefik_cloudflare_api_token: ""
-
-# Security headers middleware
-traefik_security_headers: true
-
-# Access log
-traefik_accesslog_enabled: false
-
-# Prometheus metrics
-traefik_prometheus_enabled: false

ansible/roles/traefik/tasks/main.yml

@@ -1,7 +1,9 @@
 # ------------------------------------------------------------------------------
 # FILE: roles/traefik/tasks/main.yml
-# DESCRIPTION: Deploys Traefik as a Docker Compose stack with Cloudflare
-#              DNS-01 certificate resolution for *.local.mk-labs.cloud
+# DESCRIPTION: Deploys Traefik from boilerplate-generated files in the repo.
+#              The compose.yaml and dynamic config live in boilerplates/traefik/
+#              and are copied to the host. Only the .env file is templated
+#              to inject secrets from Ansible vault.
 # ------------------------------------------------------------------------------
 
 - name: Create Traefik directory structure
@@ -13,49 +15,27 @@
     mode: '0775'
   loop:
     - "{{ traefik_base_dir }}"
-    - "{{ traefik_config_dir }}"
-    - "{{ traefik_config_dir }}/dynamic"
-    - "{{ traefik_certs_dir }}"
-    - "{{ traefik_logs_dir }}"
+    - "{{ traefik_base_dir }}/dynamic"
 
-- name: Create acme.json for certificate storage
-  file:
-    path: "{{ traefik_certs_dir }}/acme.json"
-    state: touch
-    owner: root
-    group: root
-    mode: '0600'
-    modification_time: preserve
-    access_time: preserve
-
-- name: Deploy Traefik static configuration
-  template:
-    src: traefik.yml.j2
-    dest: "{{ traefik_config_dir }}/traefik.yml"
+- name: Copy compose.yaml from boilerplate
+  copy:
+    src: "{{ playbook_dir }}/../../boilerplates/traefik/compose.yaml"
+    dest: "{{ traefik_base_dir }}/compose.yaml"
     owner: "{{ ansible_user }}"
     group: docker
     mode: '0644'
   notify: restart traefik
 
-- name: Deploy dynamic configuration
-  template:
-    src: dynamic.yml.j2
-    dest: "{{ traefik_config_dir }}/dynamic/default.yml"
+- name: Copy dynamic configuration from boilerplate
+  copy:
+    src: "{{ playbook_dir }}/../../boilerplates/traefik/dynamic/"
+    dest: "{{ traefik_base_dir }}/dynamic/"
     owner: "{{ ansible_user }}"
     group: docker
     mode: '0644'
   notify: restart traefik
 
-- name: Deploy Docker Compose file
-  template:
-    src: compose.yml.j2
-    dest: "{{ traefik_base_dir }}/compose.yml"
-    owner: "{{ ansible_user }}"
-    group: docker
-    mode: '0644'
-  notify: restart traefik
-
-- name: Deploy environment file
+- name: Deploy .env with secrets from vault
   template:
     src: env.j2
     dest: "{{ traefik_base_dir }}/.env"
@@ -66,7 +46,7 @@
 
 - name: Create Traefik Docker network
   docker_network:
-    name: "{{ traefik_network }}"
+    name: proxy
     state: present
 
 - name: Start Traefik

ansible/roles/traefik/templates/compose.yml.j2

@@ -1,36 +0,0 @@
-# ------------------------------------------------------------------------------
-# Traefik Docker Compose
-# Managed by Ansible — do not edit manually
-# ------------------------------------------------------------------------------
-
-services:
-  traefik:
-    image: traefik:{{ traefik_version }}
-    container_name: traefik
-    restart: unless-stopped
-    security_opt:
-      - no-new-privileges:true
-    ports:
-      - "{{ traefik_http_port }}:80"
-      - "{{ traefik_https_port }}:443"
-{% if traefik_dashboard_enabled %}
-      - "{{ traefik_dashboard_port }}:8080"
-{% endif %}
-    env_file:
-      - .env
-    volumes:
-      - /var/run/docker.sock:/var/run/docker.sock:ro
-      - {{ traefik_config_dir }}/traefik.yml:/etc/traefik/traefik.yml:ro
-      - {{ traefik_config_dir }}/dynamic:/etc/traefik/dynamic:ro
-      - {{ traefik_certs_dir }}/acme.json:/certs/acme.json
-{% if traefik_accesslog_enabled %}
-      - {{ traefik_logs_dir }}:/logs
-{% endif %}
-    networks:
-      - {{ traefik_network }}
-    labels:
-      - "traefik.enable=true"
-
-networks:
-  {{ traefik_network }}:
-    external: true

ansible/roles/traefik/templates/dynamic.yml.j2

@@ -1,34 +0,0 @@
-# ------------------------------------------------------------------------------
-# Traefik Dynamic Configuration
-# Managed by Ansible — do not edit manually
-# ------------------------------------------------------------------------------
-
-http:
-{% if traefik_security_headers %}
-  middlewares:
-    security-headers:
-      headers:
-        browserXssFilter: true
-        contentTypeNosniff: true
-        frameDeny: true
-        stsIncludeSubdomains: true
-        stsPreload: true
-        stsSeconds: 31536000
-        customFrameOptionsValue: "SAMEORIGIN"
-        customResponseHeaders:
-          X-Robots-Tag: "noindex,nofollow,nosnippet,noarchive,notranslate,noimageindex"
-          server: ""
-          X-Forwarded-Proto: "https"
-{% endif %}
-
-tls:
-  options:
-    default:
-      minVersion: VersionTLS12
-      cipherSuites:
-        - TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
-        - TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
-        - TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305
-        - TLS_AES_128_GCM_SHA256
-        - TLS_AES_256_GCM_SHA384
-        - TLS_CHACHA20_POLY1305_SHA256

ansible/roles/traefik/templates/traefik.yml.j2

@@ -1,68 +0,0 @@
-# ------------------------------------------------------------------------------
-# Traefik Static Configuration
-# Managed by Ansible — do not edit manually
-# ------------------------------------------------------------------------------
-
-api:
-  dashboard: {{ traefik_dashboard_enabled | lower }}
-  insecure: {{ traefik_dashboard_enabled | lower }}
-
-entryPoints:
-  web:
-    address: ":{{ traefik_http_port }}"
-{% if traefik_tls_enabled and traefik_tls_redirect %}
-    http:
-      redirections:
-        entryPoint:
-          to: websecure
-          scheme: https
-{% endif %}
-
-  websecure:
-    address: ":{{ traefik_https_port }}"
-{% if traefik_tls_enabled %}
-    http:
-      tls:
-        certResolver: {{ traefik_tls_certresolver }}
-        domains:
-          - main: "{{ traefik_domain }}"
-            sans:
-              - "*.{{ traefik_domain }}"
-{% endif %}
-
-providers:
-  docker:
-    endpoint: "unix:///var/run/docker.sock"
-    exposedByDefault: false
-    network: {{ traefik_network }}
-  file:
-    directory: /etc/traefik/dynamic
-    watch: true
-
-{% if traefik_tls_enabled %}
-certificatesResolvers:
-  {{ traefik_tls_certresolver }}:
-    acme:
-      email: "{{ traefik_tls_acme_email }}"
-      storage: /certs/acme.json
-      dnsChallenge:
-        provider: {{ traefik_tls_certresolver }}
-        resolvers:
-          - "1.1.1.1:53"
-          - "8.8.8.8:53"
-{% endif %}
-
-{% if traefik_accesslog_enabled %}
-accessLog:
-  filePath: /logs/access.log
-{% endif %}
-
-{% if traefik_prometheus_enabled %}
-metrics:
-  prometheus:
-    addEntryPointsLabels: true
-    addServicesLabels: true
-{% endif %}
-
-log:
-  level: INFO