traefik.yml

#@ load("@ytt:data", "data")
#@ load("@ytt:json", "json")

log:
  level: #@ data.values.log_level

#@ if data.values.access_logs_enabled == "true":
accessLog:
  filePath: #@ data.values.access_logs_path
  format: json
#@ end

#@ if data.values.dashboard_entrypoint_enabled == "true":
api:
  dashboard: true
#@ end

#@ if data.values.plugins == "true":
experimental:
  localPlugins:
    #@ if data.values.plugin_blockpath == "true":
    blockpath:
      modulename: github.com/traefik/plugin-blockpath
    #@ end
    #@ if data.values.plugin_maxmind_geoip == "true":
    geoip:
      modulename: github.com/forestvpn/traefikgeoip2
    #@ end
    #@ if data.values.plugin_referer == "true":
    referer:
      modulename: github.com/moonlightwatch/referer
    #@ end
    #@ if data.values.plugin_header_authorization == "true":
    headauth:
      modulename: github.com/poloyacero/headauth
    #@ end
    #@ if data.values.plugin_cert_auth == "true":
    certauthz:
      modulename: github.com/famedly/traefik-certauthz
    #@ end
    #@ if data.values.plugin_mtls_header == "true":
    mtlsheader:
      modulename: github.com/pnxs/traefik-plugin-mtls-header
    #@ end
#@ end

providers:
  #@ if data.values.file_provider == "true":
  file:
    directory: /data/config/dynamic
    watch: #@ data.values.file_provider_watch == "true"
  #@ end
  #@ if data.values.docker_provider == "true":
  docker:
    exposedByDefault: false
    constraints: #@ data.values.docker_provider_constraints
  #@ end

global:
  sendAnonymousUsage: #@ data.values.send_anonymous_usage == "true"

tls:
  #! Setup the default cert only for those domains configured for the *first* ACME cert:
  #! The expected case is that the first certificate will have a wildcard so it captures everything
  #! The thing to avoid is listing every single SAN of all the other certs, so just going to use the first one.
  #@ acme_cert_domains = json.decode(data.values.acme_cert_domains)
  #@ first_cert = acme_cert_domains[0] if len(acme_cert_domains) else []
  #@ if len(first_cert) and data.values.acme_enabled == "true":
  stores:
    default:
      defaultGeneratedCert:
        resolver: #@ data.values.acme_cert_resolver
        domain:
          main: #@ first_cert[0]
          sans:
            #@ for secondary in first_cert[1:]:
            - #@ secondary
            #@ end
  #@ end

certificatesResolvers:
  production:
    #@ if data.values.acme_enabled == "true":
    acme:
      caserver: #@ data.values.acme_cert_resolver_production
      email: #@ data.values.acme_ca_email
      storage: /data/acme-production.json
      #@ if data.values.acme_challenge.lower() in ["dns","dns-01"]:
      dnsChallenge:
        provider: #@ data.values.acme_dns_provider
      #@ elif data.values.acme_challenge.lower() in ["tls","tls-alpn-01"]:
      tlsChallenge: {}
      #@ elif data.values.acme_challenge.lower() in ["http", "http-01"]:
      httpChallenge:
        entryPoint: web
      #@ end
      certificatesDuration: #@ data.values.acme_certificates_duration
    #@ end
  staging:
    #@ if data.values.acme_enabled == "true":
    acme:
      caserver: #@ data.values.acme_cert_resolver_staging
      email: #@ data.values.acme_ca_email
      storage: /data/acme-staging.json
      #@ if data.values.acme_challenge.lower() in ["dns","dns-01"]:
      dnsChallenge:
        provider: #@ data.values.acme_dns_provider
      #@ elif data.values.acme_challenge.lower() in ["tls","tls-alpn-01"]:
      tlsChallenge: {}
      #@ elif data.values.acme_challenge.lower() in ["http", "http-01"]:
      httpChallenge:
        entryPoint: web
      #@ end
      certificatesDuration: #@ data.values.acme_certificates_duration
    #@ end

#@yaml/text-templated-strings
entryPoints:
  #@ for custom_entrypoint in data.values.custom_entrypoints.split(","):
  #@ if not len(custom_entrypoint):
  #@ continue
  #@ end
  #@ entrypoint,listen_host,listen_port,protocol,trusted_nets,use_https = custom_entrypoint.split(":")
  (@= entrypoint @):
    address: #@ listen_host + ":" + listen_port + "/" + protocol
    #@ if use_https == "true":
    http:
      tls:
        #@ if data.values.acme_enabled == "true":
        certResolver: #@ data.values.acme_cert_resolver
        domains:
          #@ for domain in json.decode(data.values.acme_cert_domains):
          - main: #@ domain[0]
            sans:
              #@ for secondary in domain[1]:
              - #@ secondary
              #@ end
          #@ end
        #@ end
      middlewares:
        - strip-headers@file
        #@ if len(data.values.error_handler_403_service):
        - traefik-websecure-error-handler-403@file
        #@ end
        #@ if len(data.values.error_handler_404_service):
        - traefik-websecure-error-handler-404@file
        #@ end
        #@ if len(data.values.error_handler_500_service):
        - traefik-websecure-error-handler-500@file
        #@ end
    #@ end
    #@ if len(trusted_nets):
    proxyProtocol:
      trustedIPs:
        #@ for allowed_net in trusted_nets.split("-"):
        - "(@= allowed_net @)"
        #@ end
    #@ end
  #@ end
  #@ if data.values.web_entrypoint_enabled == "true":
  web:
    address: #@ data.values.web_entrypoint_host + ":" + data.values.web_entrypoint_port
    #@ if len(data.values.web_entrypoint_proxy_protocol_trusted_ips.strip()):
    proxyProtocol:
      trustedIPs:
        #@ for allowed_net in data.values.web_entrypoint_proxy_protocol_trusted_ips.split(","):
        - "(@= allowed_net @)"
        #@ end
    #@ end
    http:
      redirections:
        entryPoint:
          to: websecure
  #@ end
  #@ if data.values.websecure_entrypoint_enabled == "true":
  websecure:
    address: #@ data.values.websecure_entrypoint_host + ":" + data.values.websecure_entrypoint_port
    #@ if len(data.values.websecure_entrypoint_proxy_protocol_trusted_ips.strip()):
    proxyProtocol:
      trustedIPs:
        #@ for allowed_net in data.values.websecure_entrypoint_proxy_protocol_trusted_ips.split(","):
        - "(@= allowed_net @)"
        #@ end
    #@ end
    http:
      tls:
        #@ if data.values.acme_enabled == "true":
        certResolver: #@ data.values.acme_cert_resolver
        domains:
          #@ for domain in json.decode(data.values.acme_cert_domains):
          - main: #@ domain[0]
            sans:
              #@ for secondary in domain[1]:
              - #@ secondary
              #@ end
          #@ end
        #@ end
      middlewares:
        - strip-headers@file
        #@ if len(data.values.error_handler_403_service):
        - traefik-websecure-error-handler-403@file
        #@ end
        #@ if len(data.values.error_handler_404_service):
        - traefik-websecure-error-handler-404@file
        #@ end
        #@ if len(data.values.error_handler_500_service):
        - traefik-websecure-error-handler-500@file
        #@ end
  #@ end
  #@ if data.values.xmpp_c2s_entrypoint_enabled == "true":
  xmpp_c2s:
    address: #@ data.values.xmpp_c2s_entrypoint_host + ":" + data.values.xmpp_c2s_entrypoint_port
    #@ if len(data.values.xmpp_c2s_entrypoint_proxy_protocol_trusted_ips.strip()):
    proxyProtocol:
      trustedIPs:
        #@ for allowed_net in data.values.xmpp_c2s_entrypoint_proxy_protocol_trusted_ips.split(","):
        - "(@= allowed_net @)"
        #@ end
    #@ end
  #@ end
  #@ if data.values.xmpp_s2s_entrypoint_enabled == "true":
  xmpp_s2s:
    address: #@ data.values.xmpp_s2s_entrypoint_host + ":" + data.values.xmpp_s2s_entrypoint_port
    #@ if len(data.values.xmpp_s2s_entrypoint_proxy_protocol_trusted_ips.strip()):
    proxyProtocol:
      trustedIPs:
        #@ for allowed_net in data.values.xmpp_s2s_entrypoint_proxy_protocol_trusted_ips.split(","):
        - "(@= allowed_net @)"
        #@ end
    #@ end
  #@ end
  #@ if data.values.mqtt_entrypoint_enabled == "true":
  mqtt:
    address: #@ data.values.mqtt_entrypoint_host + ":" + data.values.mqtt_entrypoint_port
    #@ if len(data.values.mqtt_entrypoint_proxy_protocol_trusted_ips.strip()):
    proxyProtocol:
      trustedIPs:
        #@ for allowed_net in data.values.mqtt_entrypoint_proxy_protocol_trusted_ips.split(","):
        - "(@= allowed_net @)"
        #@ end
    #@ end
  #@ end
  #@ if data.values.ssh_entrypoint_enabled == "true":
  ssh:
    address: #@ data.values.ssh_entrypoint_host + ":" + data.values.ssh_entrypoint_port
    #@ if len(data.values.ssh_entrypoint_proxy_protocol_trusted_ips.strip()):
    proxyProtocol:
      trustedIPs:
        #@ for allowed_net in data.values.ssh_entrypoint_proxy_protocol_trusted_ips.split(","):
        - "(@= allowed_net @)"
        #@ end
    #@ end
  #@ end
  #@ if data.values.dashboard_entrypoint_enabled == "true":
  traefik:
    address: #@ data.values.dashboard_entrypoint_host + ":" + data.values.dashboard_entrypoint_port
  #@ end
  #@ if data.values.mpd_entrypoint_enabled == "true":
  mpd:
    address: #@ data.values.mpd_entrypoint_host + ":" + data.values.mpd_entrypoint_port
    #@ if len(data.values.mpd_entrypoint_proxy_protocol_trusted_ips.strip()):
    proxyProtocol:
      trustedIPs:
        #@ for allowed_net in data.values.mpd_entrypoint_proxy_protocol_trusted_ips.split(","):
        - "(@= allowed_net @)"
        #@ end
    #@ end
  #@ end
  #@ if data.values.snapcast_entrypoint_enabled == "true":
  snapcast:
    address: #@ data.values.snapcast_entrypoint_host + ":" + data.values.snapcast_entrypoint_port
    #@ if len(data.values.snapcast_entrypoint_proxy_protocol_trusted_ips.strip()):
    proxyProtocol:
      trustedIPs:
        #@ for allowed_net in data.values.snapcast_entrypoint_proxy_protocol_trusted_ips.split(","):
        - "(@= allowed_net @)"
        #@ end
    #@ end
  #@ end
  #@ if data.values.snapcast_control_entrypoint_enabled == "true":
  snapcast_control:
    address: #@ data.values.snapcast_control_entrypoint_host + ":" + data.values.snapcast_control_entrypoint_port
    #@ if len(data.values.snapcast_control_entrypoint_proxy_protocol_trusted_ips.strip()):
    proxyProtocol:
      trustedIPs:
        #@ for allowed_net in data.values.snapcast_control_entrypoint_proxy_protocol_trusted_ips.split(","):
        - "(@= allowed_net @)"
        #@ end
    #@ end
  #@ end
  #@ if data.values.redis_entrypoint_enabled == "true":
  redis:
    address: #@ data.values.redis_entrypoint_host + ":" + data.values.redis_entrypoint_port
    #@ if len(data.values.redis_entrypoint_proxy_protocol_trusted_ips.strip()):
    proxyProtocol:
      trustedIPs:
        #@ for allowed_net in data.values.redis_entrypoint_proxy_protocol_trusted_ips.split(","):
        - "(@= allowed_net @)"
        #@ end
    #@ end
  #@ end
  #@ if data.values.rtmp_entrypoint_enabled == "true":
  rtmp:
    address: #@ data.values.rtmp_entrypoint_host + ":" + data.values.rtmp_entrypoint_port
    #@ if len(data.values.rtmp_entrypoint_proxy_protocol_trusted_ips.strip()):
    proxyProtocol:
      trustedIPs:
        #@ for allowed_net in data.values.rtmp_entrypoint_proxy_protocol_trusted_ips.split(","):
        - "(@= allowed_net @)"
        #@ end
    #@ end
  #@ end
  #@ if data.values.web_plain_entrypoint_enabled == "true":
  web_plain:
    address: #@ data.values.web_plain_entrypoint_host + ":" + data.values.web_plain_entrypoint_port
    #@ if len(data.values.web_plain_entrypoint_proxy_protocol_trusted_ips.strip()):
    proxyProtocol:
      trustedIPs:
        #@ for allowed_net in data.values.web_plain_entrypoint_proxy_protocol_trusted_ips.split(","):
        - "(@= allowed_net @)"
        #@ end
    #@ end
    http:
      middlewares:
        - strip-headers@file
        #@ if len(data.values.error_handler_403_service):
        - traefik-websecure-error-handler-403@file
        #@ end
        #@ if len(data.values.error_handler_404_service):
        - traefik-websecure-error-handler-404@file
        #@ end
        #@ if len(data.values.error_handler_500_service):
        - traefik-websecure-error-handler-500@file
        #@ end
  #@ end