traefik v0.1.0

Networking

Traefik — a modern reverse proxy and load balancer that auto-discovers your services and routes traffic to them, with a live dashboard. This pack wires Traefik to Nomad's native service provider, so jobs tagged for Traefik get routed automatically. Deployed as a host-networked Nomad service.

nomad-pack run traefik --registry nomploy

…or one line (add registry + run)

curl -fsSL https://packs.nomploy.com/install.sh | sh -s -- traefik

Needs nomad-pack on PATH. The script only adds the nomploy registry and runs this pack.

Source ↗ Project ↗ ★ 64.9k ⚑ Report an issue

1 task web 80websecure 443dashboard 8080 image traefik:v3.3 pinned :v3.3 image bumped today

Variables 11

values.hcl

Save as values.hcl, edit, then run:

nomad-pack run traefik -f values.hcl --registry nomploy

# The name of the Nomad job.
job_name = "traefik"

# The Nomad namespace to deploy into.
namespace = "default"

# The datacenters to deploy to.
datacenters = ["*"]

# The Traefik container image. Pin a tag in production.
image = "traefik:v3.3"

# Host port for the HTTP entrypoint (web).
http_port = 80

# Host port for the HTTPS entrypoint (websecure).
https_port = 443

# Host port for the Traefik dashboard/API (served insecurely — keep it internal).
dashboard_port = 8080

# Nomad HTTP API address Traefik reads services from (--providers.nomad.endpoint.address).
nomad_address = "http://127.0.0.1:4646"

# Optional Nomad ACL token for the provider (--providers.nomad.endpoint.token). Empty if ACLs are disabled.
nomad_token = ""

# Placement constraints. On a nomploy cluster: attribute = "$${meta.nomploy_control_plane}", operator = "=", value = "true".
constraints = []

# Resources for the Traefik task.
resources = {
    cpu    = 500
    memory = 256
  }

Name	Type	Default	Description
job_name	string	"traefik"	The name of the Nomad job.
namespace	string	"default"	The Nomad namespace to deploy into.
datacenters	list	["*"]	The datacenters to deploy to.
image	string	"traefik:v3.3"	The Traefik container image. Pin a tag in production.
http_port	number	80	Host port for the HTTP entrypoint (web).
https_port	number	443	Host port for the HTTPS entrypoint (websecure).
dashboard_port	number	8080	Host port for the Traefik dashboard/API (served insecurely — keep it internal).
nomad_address	string	"http://127.0.0.1:4646"	Nomad HTTP API address Traefik reads services from (--providers.nomad.endpoint.address).
nomad_token key	string	""	Optional Nomad ACL token for the provider (--providers.nomad.endpoint.token). Empty if ACLs are disabled.
constraints	list	[]	Placement constraints. On a nomploy cluster: attribute = "$${meta.nomploy_control_plane}", operator = "=", value = "true".
resources	object	{ cpu = 500 memory = 256 }	Resources for the Traefik task.

Readme

traefik

Traefik — a modern reverse proxy and load balancer that auto-discovers your services and routes traffic to them, with a live dashboard and middlewares (auth, redirects, rate limiting, …). This pack wires Traefik to Nomad's native service provider, so any Nomad job tagged for Traefik is routed automatically — no static config to maintain.

Single host-networked Nomad service.

Deploy

nomad-pack registry add nomploy https://github.com/Nomploy/nomad-packs
nomad-pack run traefik --registry=nomploy

Configure

Variable	Default	Description
`http_port` / `https_port`	`80` / `443`	HTTP (`web`) and HTTPS (`websecure`) entrypoints.
`dashboard_port`	`8080`	Dashboard/API port (served insecurely — keep internal).
`nomad_address`	`http://127.0.0.1:4646`	Nomad HTTP API Traefik reads services from.
`nomad_token`	`""`	Nomad ACL token, if ACLs are enabled.
`image`	`traefik:v3.3`	Container image. Pin a tag in production.
`resources`	`{ cpu = 500, memory = 256 }`	Task resources.

Expose a job by adding Traefik tags to its Nomad service:

tags = [
  "traefik.enable=true",
  "traefik.http.routers.myapp.rule=Host(`app.example.com`)",
]

Port conflict: this binds http_port/https_port on the node — don't run it where another ingress already listens on those ports (for example a nomploy control plane's own Traefik). For automatic TLS, add an ACME certResolver and a certs volume. Dashboard is insecure; put it behind auth or keep it internal.