Ansible role to install and configure Traefik reverse proxy.
Building and improving this Ansible role have been sponsored by my current and previous employers like Cloudpunks GmbH and Proact Deutschland GmbH.
- Requirements
- Default Variables
- traefik_accesslog_buffer
- traefik_accesslog_format
- traefik_additional_entrypoints
- traefik_additional_middlewares
- traefik_additional_ports
- traefik_api_dashboard
- traefik_api_debug
- traefik_api_enabled
- traefik_api_insecure
- traefik_cert_resolvers
- traefik_check_new_version
- traefik_dashboard_cert_resolver
- traefik_dashboard_host_rule
- traefik_dashboard_http_entrypoint
- traefik_dashboard_https_entrypoint
- traefik_dashboard_middlewares
- traefik_dashboard_users
- traefik_docker_bind_port_ip
- traefik_docker_default_rule
- traefik_docker_exposed_by_default
- traefik_docker_network_name
- traefik_environment_variables
- traefik_force_restart
- traefik_forwarding_dial_timeout
- traefik_forwarding_idle_timeout
- traefik_forwarding_response_timeout
- traefik_hostresolver_cname_flattening
- traefik_hostresolver_resolv_config
- traefik_hostresolver_resolv_depth
- traefik_image
- traefik_insecure_skip_verify
- traefik_log_format
- traefik_log_level
- traefik_max_idle_conns
- traefik_ping_entrypoint
- traefik_prometheus_buckets
- traefik_prometheus_enabled
- traefik_prometheus_entrypoint
- traefik_prometheus_entrypoint_labels
- traefik_prometheus_service_labels
- traefik_provider_throttle_duration
- traefik_proxy_dashboard
- traefik_proxy_metrics
- traefik_pull_image
- traefik_root_certificates
- traefik_send_anonymous_usage
- traefik_standard_entrypoints
- traefik_standard_middlewares
- traefik_standard_ports
- traefik_tls_additional_certificates
- traefik_tls_cipher_suites
- traefik_tls_default_certificate
- traefik_tls_min_version
- traefik_tls_standard_certificates
- traefik_tracing_128bit_spans
- traefik_tracing_collector_endpoint
- traefik_tracing_collector_password
- traefik_tracing_collector_user
- traefik_tracing_enabled
- traefik_tracing_header_name
- traefik_tracing_local_agent
- traefik_tracing_name_limit
- traefik_tracing_propagation_format
- traefik_tracing_sampling_param
- traefik_tracing_sampling_server
- traefik_tracing_sampling_type
- traefik_tracing_service_name
- traefik_version
- Discovered Tags
- Dependencies
- License
- Author
- Minimum Ansible version:
2.10
Access log buffering size
traefik_accesslog_buffer: 0Access log format
traefik_accesslog_format: commonAdditional available entrypoints
traefik_additional_entrypoints: []Additional available middlewares
traefik_additional_middlewares: []Additional available ports
traefik_additional_ports: []Enable dashboard API
traefik_api_dashboard: trueEnable debug mode within API
traefik_api_debug: falseEnable API endpoints
traefik_api_enabled: trueEnable insecure access for API
traefik_api_insecure: falseList of certificate resolvers
traefik_cert_resolvers: []traefik_cert_resolvers:
- name: default-dns
email: [email protected]
dns_challenge:
provider: cloudflare
- name: default-http
email: [email protected]
http_challenge:
entrypoint: http
- name: default-tls
email: [email protected]
tls_challenge: TrueCheck for a new version online
traefik_check_new_version: falseCert resolver for the dashboard
traefik_dashboard_cert_resolver:Host rule for the dashboard
traefik_dashboard_host_rule: '{{ ansible_fqdn }}'Insecure entrypoint for the dashboard
traefik_dashboard_http_entrypoint: httpSecure entrypoint for the dashboard
traefik_dashboard_https_entrypoint: httpsMiddlewares used for the dashboard
traefik_dashboard_middlewares:
- traefik@fileUsers used for the dashboard
traefik_dashboard_users: []Use bind port ip for docker provider
traefik_docker_bind_port_ip: falseDefault rule for docker provider
traefik_docker_default_rule: !unsafe 'Host(`{{ normalize .Name }}`)'Expose service by default for docker provider
traefik_docker_exposed_by_default: falseDocker network used by docker provider
traefik_docker_network_name:traefik_docker_network_name: traefikList of available environment variables
traefik_environment_variables: []traefik_environment_variables:
- key: CF_API_EMAIL
value: [email protected]
- key: CF_API_KEY
value: as0oiGu2Chier3aepaeceeG7oiY2aezawe5teForce a restart of the service
traefik_force_restart: falseServer transport forwarding dial timeout
traefik_forwarding_dial_timeout: 30Server transport forwarding idle connection timeout
traefik_forwarding_idle_timeout: 90Server transport forwarding response timeout
traefik_forwarding_response_timeout: 0Enable cname flattening for resolver
traefik_hostresolver_cname_flattening: falsePath to host resolv config
traefik_hostresolver_resolv_config: /etc/resolv.confMax resolv depth for the host resolver
traefik_hostresolver_resolv_depth: 5Docker image to use
traefik_image: library/traefik:{{ traefik_version }}Server transport insecure skip verify
traefik_insecure_skip_verify: trueGeneral log format
traefik_log_format: commonGeneral log level
traefik_log_level: ERRORServer transport max idle connections per host
traefik_max_idle_conns: 100Entrypoint used for ping
traefik_ping_entrypoint:List of buckets for prometheus metrics
traefik_prometheus_buckets:
- 0.1
- 0.3
- 1.2
- 5.0Enable prometheus exporter
traefik_prometheus_enabled: trueEntrypoint used for prometheus metrics
traefik_prometheus_entrypoint: metricsAdd entrypoint labels for prometheus metrics
traefik_prometheus_entrypoint_labels: trueAdd service labels for prometheus metrics
traefik_prometheus_service_labels: trueProvider throttle duration
traefik_provider_throttle_duration: 0Enable builtin rules for dashboard
traefik_proxy_dashboard: trueEnable builtin rules for metrics
traefik_proxy_metrics: truePull image as part of the tasks
traefik_pull_image: trueList of available root certificates
traefik_root_certificates: []traefik_root_certificates:
- /path/to/root1.crt
- /path/to/root2.crt
- /path/to/root3.crtSend anonymous usage information to authors
traefik_send_anonymous_usage: trueGeneral available entrypoints
traefik_standard_entrypoints:
- name: metrics
address: :8082
- name: traefik
address: :8080
- name: http
address: :80
- name: https
address: :443General available middlewares
traefik_standard_middlewares:
- name: traefik
kind: basicAuth
attrs:
users: '{{ traefik_dashboard_users }}'
realm: Traefik
- name: https
kind: redirectScheme
attrs:
scheme: https
permanent: true
- name: secure
kind: headers
attrs:
forceSTSHeader: true
stsIncludeSubdomains: false
stsPreload: true
stsSeconds: 315360000
sslRedirect: true
customFrameOptionsValue: SAMEORIGIN
contentTypeNosniff: true
browserXssFilter: true
referrerPolicy: strict-origin-when-cross-originGeneral available ports
traefik_standard_ports:
- 80:80
- 443:443Additional available certificates
traefik_tls_additional_certificates: []traefik_tls_additional_certificates:
- crt: /etc/ssl/certs/wildcard.example.com.crt
key: /etc/ssl/private/wildcard.example.com.key
- crt: /etc/ssl/certs/wildcard.foo.com.crt
key: /etc/ssl/private/wildcard.foo.com.key
- crt: /etc/ssl/certs/wildcard.bar.com.crt
key: /etc/ssl/private/wildcard.bar.com.keyCipher suites to enable for TLS
traefik_tls_cipher_suites:
- TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
- TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
- TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305
- TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305
- TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
- TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
- TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA
- TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
- TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256
- TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256Default certificate used for any request without a matching router
traefik_tls_default_certificate:traefik_tls_default_certificate:
crt: /etc/ssl/certs/wildcard.example.com.crt
key: /etc/ssl/private/wildcard.example.com.key
generated:
resolver: default
domain:
main: example.com
sans:
- dummy.example.comMinimal version used for TLS
traefik_tls_min_version: VersionTLS12General available certificates
traefik_tls_standard_certificates: []traefik_tls_standard_certificates:
- crt: /etc/ssl/certs/wildcard.example.com.crt
key: /etc/ssl/private/wildcard.example.com.key
- crt: /etc/ssl/certs/wildcard.foo.com.crt
key: /etc/ssl/private/wildcard.foo.com.key
- crt: /etc/ssl/certs/wildcard.bar.com.crt
key: /etc/ssl/private/wildcard.bar.com.keyJaeger tracing gen 128bit spans
traefik_tracing_128bit_spans: falseJaeger tracing collector endpoint
traefik_tracing_collector_endpoint:Jaeger tracing collector password
traefik_tracing_collector_password:Jaeger tracing collector user
traefik_tracing_collector_user:Enable distributed tracing
traefik_tracing_enabled: falseJaeger tracing context header name
traefik_tracing_header_name: uber-trace-idJaeger tracing local agent host and port
traefik_tracing_local_agent:Tracing span name limit
traefik_tracing_name_limit: 0Jaeger tracing propagation format
traefik_tracing_propagation_format: jaegerJaeger tracing sampling rate
traefik_tracing_sampling_param: 1.0Jaeger tracing sampling server url
traefik_tracing_sampling_server:Jaeger tracing sampling type
traefik_tracing_sampling_type: constTracing service name to send
traefik_tracing_service_name: traefikVersion of the Docker image
traefik_version: v3.2.3traefik
Apache-2.0