cluster/infrastructure/ingress/nomad.hcl

job "ingress" {
  datacenters = [ "do-1" ]
  type = "service"

  constraint {
    attribute = "${attr.unique.hostname}"
    value = "toothpick"
  }

  group "ingress" {
    count = 1

    volume "ingress-letsencrypt" {
      type = "csi"
      source = "ingress-letsencrypt"
      read_only = false

      attachment_mode = "file-system"
      access_mode     = "single-node-writer"
    }

    network {
      mode = "bridge"
      port "http" {
	static = "80"
	to = "80"
	host_network = "public"
      }

      port "https" {
	static = "443"
	to = "443"
	host_network = "public"
      }
    }

    service {
      name = "ingress"
      port = "http"

      connect {
	sidecar_service {
	  proxy {
	    upstreams {
	      destination_name = "gitea"
	      local_bind_port  = 3000
	      datacenter = "homelab-1"

	      mesh_gateway {
		mode = "local"
	      }
	    }

	    upstreams {
	      destination_name = "hydra"
	      local_bind_port  = 8666
	      datacenter = "homelab-1"

	      mesh_gateway {
		mode = "local"
	      }
	    }

	    upstreams {
	      destination_name = "nextcloud"
	      local_bind_port  = 8777
	      datacenter = "homelab-1"

	      mesh_gateway {
		mode = "local"
	      }
	    }

	    upstreams {
	      destination_name = "website"
	      local_bind_port  = 8080
	      datacenter = "homelab-1"

	      mesh_gateway {
		mode = "local"
	      }
	    }
	  }
	}
      }
    }

    task "nginx" {
      driver = "docker"

      volume_mount {
	volume = "ingress-letsencrypt"
	destination = "/etc/letsencrypt"
	read_only = false
      }

      config {
	image = "nixng-ingress:local"
	ports = ["http", "https"]
      }

      resources {
	cpu = 200
	memory = 32
      }

      template {
	data = <<EOF
ssl_certificate_key /etc/letsencrypt/live/redalder.org/privkey.pem;
ssl_certificate /etc/letsencrypt/live/redalder.org/fullchain.pem;

ssl_session_cache shared:le_nginx_SSL:10m;
ssl_session_timeout 1440m;
ssl_session_tickets off;

ssl_protocols TLSv1.2 TLSv1.3;
ssl_prefer_server_ciphers off;

ssl_ciphers "ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384";
EOF
        destination   = "local/ssl.conf"
        change_mode   = "signal"
        change_signal = "SIGHUP"
      }

      template {
	data = <<EOF
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
EOF
	destination   = "local/headers.conf"
	change_mode   = "signal"
	change_signal = "SIGHUP"
      }

      template {
	data = <<EOF
add_header X-Frame-Options "SAMEORIGIN";
add_header Content-Security-Policy "default-src 'self' http: https: data: blob: 'unsafe-inline'" always;
EOF
	destination   = "local/security.conf"
	change_mode   = "signal"
	change_signal = "SIGHUP"
      }

      template {
	data = <<EOF
upstream gitea {
  server {{ env "NOMAD_UPSTREAM_ADDR_gitea" }};
}

upstream hydra {
  server {{ env "NOMAD_UPSTREAM_ADDR_hydra" }};
}

upstream nextcloud {
  server {{ env "NOMAD_UPSTREAM_ADDR_nextcloud" }};
}

upstream website {
  server {{ env "NOMAD_UPSTREAM_ADDR_website" }};
}

server {
  listen 443 ssl;
  
  server_name _;

  include /local/ssl.conf;

  return 404;
}

server {
  listen 443 ssl;
  
  server_name gitea.redalder.org;

  include /local/security.conf;
  include /local/ssl.conf;

  client_max_body_size 100M;

  location / {
    include /local/headers.conf;
    proxy_pass http://gitea;
  }
}

server {
  listen 443 ssl;
   
  server_name hydra.redalder.org;

  include /local/security.conf;
  include /local/ssl.conf;

  location / {
    include /local/headers.conf;
    proxy_pass http://hydra;
  }
}

server {
  listen 443 ssl;

  server_name redalder.org nixng.org;
  
  include /local/security.conf;
  include /local/ssl.conf;

  location /nextcloud/ {
    include /local/headers.conf;
    proxy_pass http://nextcloud/;
  }

  location / {
    include /local/headers.conf;
    proxy_pass http://website;
  }
}
EOF
        destination   = "local/upstreams.conf"
        change_mode   = "signal"
        change_signal = "SIGHUP"
      }
    }
  }
}