modules/dummy/jobspec.nomad.hcl

@@ -1,15 +1,8 @@
 job "hello-world" {
-  group "servers" {
+  datacenters = ["dc1"]
 
-    network {
+  group "servers" {
-      mode = "bridge"
+    count = 1
-      port "www" {
-        to = 8001
-      }
-      port "envoy_metrics" {
-        to = 9102
-      }
-    }
 
     task "web" {
       driver = "docker"
@@ -32,30 +25,20 @@ job "hello-world" {
       }
     }
 
-    service {
+    network {
-      port     = 8001
+      mode = "bridge"
-      provider = "consul"
+      port "www" {
-
+        to = 8001
-      connect {
-        sidecar_service {
-          proxy {
-            expose {
-              path {
-                path            = "/metrics"
-                protocol        = "http"
-                local_path_port = 9102
-                listener_port   = "envoy_metrics"
-              }
-            }
-            transparent_proxy {}
-          }
-        }
       }
+    }
+
+    service {
+      port     = "www"
+      provider = "consul"
 
       tags = [
         "traefik.enable=true",
         "traefik.http.routers.web.rule=Host(`hello-world.brmartin.co.uk`)",
-        "traefik.consulcatalog.connect=true",
       ]
     }
   }

modules/jayne-martin-counselling/jobspec.nomad.hcl

@@ -50,14 +50,41 @@ job "jayne-martin-counselling" {
           }
         }
       }
+    }
+  }
 
+  group "webserver-ingress-group" {
+
+    network {
+      mode = "bridge"
+      port "inbound" {
+        to = 8080
+      }
+    }
+
+    service {
+      port = "inbound"
       tags = [
         "traefik.enable=true",
 
         "traefik.http.routers.jmc.rule=Host(`www.jaynemartincounselling.co.uk`)",
-        "traefik.http.routers.jmc.entrypoints=websecure",
+        "traefik.http.routers.jmc.entrypoints=websecure"
-        "traefik.consulcatalog.connect=true",
       ]
+
+      connect {
+        gateway {
+          ingress {
+            listener {
+              port     = 8080
+              protocol = "http"
+              service {
+                name  = "jayne-martin-counselling-webserver"
+                hosts = ["*"]
+              }
+            }
+          }
+        }
+      }
     }
   }
 }

modules/keycloak/jobspec.nomad.hcl

@@ -38,14 +38,6 @@ job "keycloak" {
           }
         }
       }
-
-      tags = [
-        "traefik.enable=true",
-
-        "traefik.http.routers.keycloak.rule=Host(`sso.brmartin.co.uk`)",
-        "traefik.http.routers.keycloak.entrypoints=websecure",
-        "traefik.consulcatalog.connect=true",
-      ]
     }
 
     task "keycloak" {
@@ -93,4 +85,39 @@ job "keycloak" {
       "service.name" = "keycloak"
     }
   }
+
+  group "keycloak-ingress-group" {
+
+    network {
+      mode = "bridge"
+      port "inbound" {
+        to = 8080
+      }
+    }
+
+    service {
+      port = "inbound"
+      tags = [
+        "traefik.enable=true",
+
+        "traefik.http.routers.keycloak.rule=Host(`sso.brmartin.co.uk`)",
+        "traefik.http.routers.keycloak.entrypoints=websecure",
+      ]
+
+      connect {
+        gateway {
+          ingress {
+            listener {
+              port     = 8080
+              protocol = "http"
+              service {
+                name  = "keycloak-keycloak"
+                hosts = ["*"]
+              }
+            }
+          }
+        }
+      }
+    }
+  }
 }

modules/matrix/jobspec.nomad.hcl

@@ -51,19 +51,6 @@ job "matrix" {
           }
         }
       }
-
-      tags = [
-        "traefik.enable=true",
-
-        "traefik.http.routers.synapse.rule=Host(`matrix.brmartin.co.uk`)",
-        "traefik.http.routers.synapse.entrypoints=websecure",
-        "traefik.http.routers.synapse.middlewares=synapseHeaders,synapseBuffering",
-        "traefik.http.middlewares.synapseHeaders.headers.accesscontrolallowmethods=GET,POST,PUT,DELETE,OPTIONS",
-        "traefik.http.middlewares.synapseHeaders.headers.accesscontrolallowheaders=Origin,X-Requested-With,Content-Type,Accept,Authorization",
-        "traefik.http.middlewares.synapseHeaders.headers.accesscontrolalloworiginlist=*",
-        "traefik.http.middlewares.synapseBuffering.buffering.maxRequestBodyBytes=1000000000",
-        "traefik.consulcatalog.connect=true",
-      ]
     }
 
     task "synapse" {
@@ -333,14 +320,6 @@ job "matrix" {
           }
         }
       }
-
-      tags = [
-        "traefik.enable=true",
-
-        "traefik.http.routers.mas.rule=Host(`mas.brmartin.co.uk`) || (Host(`matrix.brmartin.co.uk`) && PathRegexp(`^/_matrix/client/(.*)/(login|logout|refresh)`))",
-        "traefik.http.routers.mas.entrypoints=websecure",
-        "traefik.consulcatalog.connect=true",
-      ]
     }
 
     task "mas" {
@@ -408,17 +387,6 @@ job "matrix" {
           }
         }
       }
-
-      tags = [
-        "traefik.enable=true",
-
-        "traefik.http.routers.matrixWellKnown.rule=PathPrefix(`/.well-known/matrix`)",
-        "traefik.http.routers.matrixWellKnown.entrypoints=websecure",
-        "traefik.http.routers.matrixWellKnown.middlewares=matrixWellKnown",
-        "traefik.http.middlewares.matrixWellKnown.headers.accesscontrolalloworiginlist=*",
-        "traefik.consulcatalog.connect=true",
-      ]
-
     }
 
     task "nginx" {
@@ -495,6 +463,123 @@ job "matrix" {
     }
   }
 
+  group "synapse-ingress-group" {
+
+    network {
+      mode = "bridge"
+      port "inbound" {
+        to = 8080
+      }
+    }
+
+    service {
+      port = "inbound"
+      tags = [
+        "traefik.enable=true",
+
+        "traefik.http.routers.synapse.rule=Host(`matrix.brmartin.co.uk`)",
+        "traefik.http.routers.synapse.entrypoints=websecure",
+        "traefik.http.routers.synapse.middlewares=synapseHeaders,synapseBuffering",
+        "traefik.http.middlewares.synapseHeaders.headers.accesscontrolallowmethods=GET,POST,PUT,DELETE,OPTIONS",
+        "traefik.http.middlewares.synapseHeaders.headers.accesscontrolallowheaders=Origin,X-Requested-With,Content-Type,Accept,Authorization",
+        "traefik.http.middlewares.synapseHeaders.headers.accesscontrolalloworiginlist=*",
+        "traefik.http.middlewares.synapseBuffering.buffering.maxRequestBodyBytes=1000000000",
+      ]
+
+      connect {
+        gateway {
+          proxy {
+            config {
+              local_idle_timeout_ms = 120000
+            }
+          }
+          ingress {
+            listener {
+              port     = 8080
+              protocol = "http"
+              service {
+                name  = "matrix-synapse"
+                hosts = ["*"]
+              }
+            }
+          }
+        }
+      }
+    }
+  }
+
+  group "mas-ingress-group" {
+
+    network {
+      mode = "bridge"
+      port "inbound" {
+        to = 8080
+      }
+    }
+
+    service {
+      port = "inbound"
+      tags = [
+        "traefik.enable=true",
+
+        "traefik.http.routers.mas.rule=Host(`mas.brmartin.co.uk`) || (Host(`matrix.brmartin.co.uk`) && PathRegexp(`^/_matrix/client/(.*)/(login|logout|refresh)`))",
+        "traefik.http.routers.mas.entrypoints=websecure",
+      ]
+
+      connect {
+        gateway {
+          ingress {
+            listener {
+              port     = 8080
+              protocol = "http"
+              service {
+                name  = "matrix-mas"
+                hosts = ["*"]
+              }
+            }
+          }
+        }
+      }
+    }
+  }
+
+  group "wellknown-ingress-group" {
+
+    network {
+      mode = "bridge"
+      port "inbound" {
+        to = 8080
+      }
+    }
+
+    service {
+      port = "inbound"
+      tags = [
+        "traefik.enable=true",
+
+        "traefik.http.routers.matrixWellKnown.rule=PathPrefix(`/.well-known/matrix`)",
+        "traefik.http.routers.matrixWellKnown.entrypoints=websecure",
+        "traefik.http.routers.matrixWellKnown.middlewares=matrixWellKnown",
+        "traefik.http.middlewares.matrixWellKnown.headers.accesscontrolalloworiginlist=*",
+      ]
+
+      connect {
+        gateway {
+          ingress {
+            listener {
+              port     = 8080
+              protocol = "http"
+              service {
+                name  = "matrix-nginx"
+                hosts = ["*"]
+              }
+            }
+          }
+        }
+      }
+    }
+  }
+
   group "element" {
 
     network {

modules/media-centre/jobspec.nomad.hcl

@@ -97,14 +97,6 @@ job "media-centre" {
           }
         }
       }
-
-      tags = [
-        "traefik.enable=true",
-
-        "traefik.http.routers.plex.entrypoints=websecure",
-        "traefik.http.routers.plex.rule=Host(`plex.brmartin.co.uk`)",
-        "traefik.consulcatalog.connect=true",
-      ]
     }
 
     network {
@@ -160,4 +152,39 @@ job "media-centre" {
       }
     }
   }
+
+  group "plex-ingress-group" {
+
+    network {
+      mode = "bridge"
+      port "inbound" {
+        to = 8080
+      }
+    }
+
+    service {
+      port = "inbound"
+      tags = [
+        "traefik.enable=true",
+
+        "traefik.http.routers.plex.entrypoints=websecure",
+        "traefik.http.routers.plex.rule=Host(`plex.brmartin.co.uk`)"
+      ]
+
+      connect {
+        gateway {
+          ingress {
+            listener {
+              port     = 8080
+              protocol = "http"
+              service {
+                name  = "media-centre-plex"
+                hosts = ["*"]
+              }
+            }
+          }
+        }
+      }
+    }
+  }
 }

modules/ollama/jobspec.nomad.hcl

@@ -133,14 +133,41 @@ job "ollama" {
           }
         }
       }
+    }
+  }
 
+  group "open-webui-ingress-group" {
+
+    network {
+      mode = "bridge"
+      port "inbound" {
+        to = 8080
+      }
+    }
+
+    service {
+      port = "inbound"
       tags = [
         "traefik.enable=true",
 
         "traefik.http.routers.openwebui.rule=Host(`eos.brmartin.co.uk`)",
-        "traefik.http.routers.openwebui.entrypoints=websecure",
+        "traefik.http.routers.openwebui.entrypoints=websecure"
-        "traefik.consulcatalog.connect=true",
       ]
+
+      connect {
+        gateway {
+          ingress {
+            listener {
+              port     = 8080
+              protocol = "http"
+              service {
+                name  = "ollama-open-webui"
+                hosts = ["*"]
+              }
+            }
+          }
+        }
+      }
     }
   }
 }