cluster/nomad/regions/homelab-1/job/ingress.hcl

variable "flake_ref" {
  type = string
}

variable "flake_sha" {
  type = string
}

variable "upstreams" {
  type = string
}

job "ingress" {
  datacenters = [ "homelab-1" ]
  type = "service"

  group "ingress" {
    count = 1

    constraint {
      attribute = "${attr.unique.hostname}"
      value = "blowhole"
    }

    network {
      mode = "bridge"
      port "http" {
        static = 8080
        to = 80
      }

      port "https" {
        static = 443
        to = 443
      }

      port "jellyfin" {
        static = 8096
        to = 8096
      }

      port "imap" {
        static = 143
        to = 143
      }
    }

    service {
      name = "ingress-blowhole"
      port = "80"

      connect {
        sidecar_service {
          proxy {
            upstreams {
              destination_name = "jellyfin"
              local_bind_port  = 8001
            }

            upstreams {
              destination_name = "zigbee2mqtt"
              local_bind_port  = 8002
            }

            upstreams {
              destination_name = "home-assistant"
              local_bind_port  = 8003
            }

            upstreams {
              destination_name = "syncthing"
              local_bind_port  = 8004
            }

            upstreams {
              destination_name = "dovecot-imap"
              local_bind_port  = 8005
            }

            upstreams {
              destination_name = "baikal"
              local_bind_port  = 8006
            }
          }
        }

        sidecar_task {
          resources {
            cpu = 75
            memory = 48
          }

          config {
            memory_hard_limit = 96
            image = "envoyproxy/envoy:v1.20.2"
          }
        }
      }
    }

    task "nginx" {
      driver = "docker"

      config {
        nix_flake_ref = "${var.flake_ref}#nixngSystems.ingressBlowhole.config.system.build.toplevel"
        nix_flake_sha = var.flake_sha
        entrypoint = [ "init" ]
      }

      resources {
        cpu = 200
        memory = 32
        memory_max = 128
      }

      template {
        data = <<EOF
ssl_certificate_key /etc/letsencrypt/live/redalder.org/privkey.pem;
ssl_certificate /etc/letsencrypt/live/redalder.org/fullchain.pem;

ssl_session_cache shared:le_nginx_SSL:10m;
ssl_session_timeout 1440m;
ssl_session_tickets off;

ssl_protocols TLSv1.2 TLSv1.3;
ssl_prefer_server_ciphers off;

ssl_ciphers "ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384";
EOF
        destination   = "local/ssl.conf"
        change_mode   = "signal"
        change_signal = "SIGHUP"
      }

      template {
        data = <<EOF
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
EOF
        destination   = "local/headers.conf"
        change_mode   = "signal"
        change_signal = "SIGHUP"
      }

      template {
        data = <<EOF
add_header X-Frame-Options "SAMEORIGIN";
add_header Content-Security-Policy "default-src 'self' http: https: data: blob: 'unsafe-inline'" always;
EOF
        destination   = "local/security.conf"
        change_mode   = "signal"
        change_signal = "SIGHUP"
      }

      template {
        data = var.upstreams

        destination   = "local/upstreams.conf"
        change_mode   = "signal"
        change_signal = "SIGHUP"
      }

      template {
        data = <<EOF
upstream dovecot-imap {
  server {{ env "NOMAD_UPSTREAM_ADDR_dovecot-imap" }};
}

server {
  listen 143;

  proxy_pass dovecot-imap;
}
EOF
        destination   = "local/streams.conf"
        change_mode   = "signal"
        change_signal = "SIGHUP"
      }
    }
  }
}