FEAT: traefik - LE tlsChallenge, more customization options

roles/traefik/defaults/main.yml

@@ -9,6 +9,13 @@ traefik_enabled: false
 # directories
 traefik_data_directory: "{{ docker_home }}/traefik"
 
+# files
+traefik_template_files:
+  - src: traefik.toml
+    dest: "{{ traefik_data_directory }}/traefik.toml"
+    force: "Yes"
+traefik_template_files_custom: []
+
 # network
 traefik_port_http: "80"
 traefik_port_https: "443"
@@ -19,11 +26,22 @@ traefik_image_name: "traefik"
 traefik_image_version: "latest"
 traefik_log_level: "INFO"
 
+traefik_volumes:
+  - "{{ traefik_data_directory }}/letsencrypt:/letsencrypt:rw"
+  - "{{ traefik_data_directory }}/traefik.toml:/etc/traefik/traefik.toml:ro"
+  - "/var/run/docker.sock:/var/run/docker.sock:ro"
+traefik_volumes_custom: []
+
 # find the relevant name and environment variables for your DNS provider at https://go-acme.github.io/lego/dns/.
 # More info at https://doc.traefik.io/traefik/https/acme/
 traefik_dns_provider: cloudflare
 traefik_environment_variables:
   CF_DNS_API_TOKEN: "abcdabcd123412341234"
+traefik_letsencrypt_tls: no
+
+traefik_domain_san:
+  - "*.{{ ansible_nas_domain }}"
+traefik_domain_san_custom: []
 
 # Ansible-NAS requests a wildcard certificate for your domain, so there should be no reason to have to use the staging
 # letsencrypt acme server. If you do want to flip between staging/production, you might need to stop Traefik and clear

roles/traefik/tasks/main.yml

@@ -11,8 +11,11 @@
 
     - name: Template Traefik config.toml
       ansible.builtin.template:
-        src: traefik.toml
-        dest: "{{ traefik_data_directory }}/traefik.toml"
+        dest: "{{ item.dest }}"
+        force: "{{ item.force | default('No') }}"
+        mode: "{{ item.mode | default('0600') }}"
+        src: "{{ item.src }}"
+      with_items: "{{ traefik_template_files + traefik_template_files_custom | sort }}"
       register: template_config
 
     - name: Traefik Docker Container
@@ -21,10 +24,7 @@
         image: "{{ traefik_image_name }}:{{ traefik_image_version }}"
         pull: true
         network_mode: host
-        volumes:
-          - "{{ traefik_data_directory }}/traefik.toml:/etc/traefik/traefik.toml:ro"
-          - "{{ traefik_data_directory }}/letsencrypt:/letsencrypt:rw"
-          - "/var/run/docker.sock:/var/run/docker.sock:ro"
+        volumes: "{{ traefik_volumes + traefik_volumes_custom | sort }}"
         env: "{{ traefik_environment_variables }}"
         restart_policy: unless-stopped
         memory: "{{ traefik_memory }}"

roles/traefik/templates/traefik.toml

@@ -13,9 +13,7 @@
 
         [entryPoints.websecure.http.tls.domains]
           main = "{{ ansible_nas_domain }}"
-          sans = [
-            "*.{{ ansible_nas_domain }}"
-          ]
+          sans = {{ (traefik_domain_san + traefik_domain_san_custom ) | to_nice_json(indent=2) | trim | indent(10) }}
 
   [entryPoints.traefik]
     address = ":{{ traefik_port_ui }}"
@@ -30,7 +28,7 @@
   dashboard = true
 
 [log]
-  level = "{{ traefik_log_level }}"
+  level = "{{ traefik_log_level | upper }}"
 
 [ping]
   terminatingStatusCode = 0
@@ -47,3 +45,13 @@
 
 [metrics]
   [metrics.prometheus]
+
+{% if traefik_letsencrypt_tls %}
+  [certificatesResolvers.letsencryptTls]
+    [certificatesResolvers.letsencryptTls.acme]
+      email = "{{ ansible_nas_email }}"
+      storage = "/letsencrypt/acme.json"
+      caserver = "https://acme-v02.api.letsencrypt.org/directory"
+
+      [certificatesResolvers.letsencryptTls.acme.tlsChallenge]
+{% endif %}