job "ingress" {
  # Using my nomad DC (default value)
  datacenters = ["dc1"]

  # Define the scheduler type
  # Refere to citizen job for more informations
  type        = "system"

  group "ingress" {
    # We require only one pod
    count = 1

    # Claim volume acme defined from client configuration
    volume "acme" {
      type      = "host"
      source    = "acme"
      read_only = false
    }

    # Creat my network configuration
    network {
      # Http port use by traefik for public trafic map on port 80 on the host
      port "http" {
        static = 80
      }

      # Https port use by traefik for public trafic map on port 443 on the host
      port "https" {
        static = 443
      }

      # Traefik dashboard's port used for rescue map on port 8081 on the host
      port "traefik" {
        static = 8081
      }
    }

    # Expose my diffrents services
    # I don't use consul, so I declare the provider name `nomad`
    service {
      provider = "nomad"
      name     = "http"
      port     = "http"
    }

    service {
      provider = "nomad"
      name     = "https"
      port     = "https"
    }

    service {
      provider = "nomad"
      port     = "traefik"
    }

    # Create my task whith my container configuration
    task "traefik" {
      # Define the driver
      driver = "docker"

      # Claim my vault policy I need to get my secrets
      vault {
        policies = ["route53"]
      }

      # Set up some cpu/ram limitation
      resources {
        cpu    = 200
        memory = 128
      }

      # Mount my volume acme on my pod in /etc/acme
      volume_mount {
        volume      = "acme"
        destination = "/etc/acme"
      }

      # Container configuration
      config {
        # Image name
        image = "traefik:v2.10.3"

        # Exposed port (used by services)
        ports = ["https", "http", "traefik"]

        # Mount my volumes
        volumes = [
          "/etc/ssl/certs:/certs", # This volume is directly on the host, require for nomad CA
          "local/traefik.yml:/etc/traefik/traefik.yml",
        ]
      }

    # Create configuration file shared on the container
     template {
       data        = <<EOH
---
http:
  # Default routers
  routers:
    # Set up traefk public dashboard access
    api:
      # Use tls
      tls: true

      # Limited on nomad.p0l.io/traefik and nomad.p0l.io/api for IP 1.2.3.4
      rule: Host(`nomad.p0l.io`) && (PathPrefix(`/traefik`) || PathPrefix(`/api`)) && ClientIP(`1.2.3.4`)

      # Use service api@internal
      # This is a intenal service created by traefik when api is on
      service: api@internal

      # Use custom middlewares traefik
      middlewares: traefik

    # Set up nomad consol access (pretty same configuration)
    nomad:
      tls: true
      rule: Host(`nomad.p0l.io`) && (PathPrefix(`/v1`) || PathPrefix(`/ui`)) && ClientIP(`1.2.3.4`)
      # Use my service created on my file provider
      service: nomad@file
      middlewares: nomad

  # Services
  services:
    # Create my service nomad, it's can be used by service `nomad@file`
    nomad:
      loadBalancer:
        servers:
          - url: https://{{ env "NOMAD_IP_traefik" }}:4646

  # Adding my nomad CA for my service
  serversTransports:
    mytransport:
      rootCAs:
        - /certs/consul-ca.pem

  # Middlewares
  middlewares:
    # Create a stripprefix to allo my dashboard on /traefik
    # https://doc.traefik.io/traefik/middlewares/http/stripprefix
    traefik:
      stripprefix:
        prefixes: /traefik
    nomad:
      stripprefix:
        prefixes: /nomad
...
EOH
       # My template location
       destination = "/local/dynamic.yml"
     }

      template {
        data = <<EOF
---
# Setup default endpoints
entryPoints:
  # Enable http trafic on port 80
  http:
    address: ':80'
    http:
      # Redirect all my trafic on entryPoints https
      redirections:
        entryPoint:
          to: https
          scheme: https
          permanent: true
  # Enable https trafic on port 443
  https:
    address: ':443'
  # Enable traefik consol on port 8081
  traefik:
    address: ':8081'

log:
  level: INFO

# Enable acces log
accessLog: {}

# Enable api/dashboard
api: {}

# Enable healtthcheck endpoint
ping: {}

providers:
  providersThrottleDuration: 5s
  # Create my file provider for dynamic configuration
  file:
    watch: true
    # Related with my previous template location
    filename: '/local/dynamic.yml'

  # Enable nomad provider
  nomad:
    refreshInterval: 5s

    # Define nomad endpoint to scrape
    endpoint:
      address: https://{{ env "NOMAD_IP_traefik" }}:4646
      # Require if you have a custom CA.
      # The file location is related by
      #  * My volume shared "/etc/ssl/certs:/certs"
      #  * My tls nomad configuration
      tls:
        ca: /certs/consul-ca.pem

    # Use a tag filter to enable traefik ingress
    constraints: "Tag(`traefik.enable=true`)"

# Creaticate configuration
# acme = letsencrypt
# https://doc.traefik.io/traefik/https/acme/#the-different-acme-challenges
certificatesResolvers:
  # My resolver name
  route53:
    acme:
      # Set up email address used for your LE certificat
      email: fake@p0l.io

      # Add additional chain
      preferredChain: 'ISRG Root X1'

      # Define a cache storage (require if you destroy you container)
      # This directory is related by a host volume
      storage: /etc/acme/acme.json

      # Use dns challenge with route 53 provider
      dnsChallenge:
        provider: route53

  # Add a additional resolver
  http:
    acme:
      email: fake@p0l.io
      preferredChain: 'ISRG Root X1'

      # Use a diffrent cache file
      storage: /etc/acme/http.json

      # User http challenge
      httpChallenge:
        entryPoint: http
EOF

        destination = "local/traefik.yml"
      }

      # Create a environment variable configuration
      template {
        data = <<EOF
# Use my vault secret `from/vault/path`
{{ with secret "from/vault/path" }}
AWS_ACCESS_KEY_ID={{ .Data.data.id }}
AWS_SECRET_ACCESS_KEY={{ .Data.data.secret }}
AWS_REGION={{ .Data.data.region }}
{{ end }}
EOF
        # Should be on a diffrent destination path
        destination = "secrets/file.env"
        # Define is a environment file
        env         = true
      }
    }
  }
}

job "citizen" {
  datacenters = ["dc1"]
  type        = "service"

  group "citizen" {
    count = 1

    volume "citizen" {
      type      = "host"
      source    = "citizen"
      read_only = false
    }

    network {
      port "citizen" {
        to = 3000
      }
    }

    service {
      provider = "nomad"

      tags = [
        "citizen", "app",
        "traefik.enable=true",
        "traefik.http.routers.citizen.rule=(Host(`terraform.p0l.io`) && Method(`GET`)) || (Host(`terraform.p0l.io`) && ClientIP(`1.2.3.4`))",
        "traefik.http.routers.citizen.tls=true",
        "traefik.http.routers.citizen.tls.certresolver=http"
      ]

      port = "citizen"

      check {
        type     = "http"
        name     = "citizen"
        path     = "/health"
        interval = "10s"
        timeout  = "5s"

        check_restart {
          limit = 2
          grace = "20s"
        }
      }
    }

    task "citizen" {
      driver = "docker"

      env {
        CITIZEN_DATABASE_TYPE = "sqlite"
        CITIZEN_DATABASE_URL = "/citizen/data"
        CITIZEN_STORAGE = "file"
        CITIZEN_STORAGE_PATH = "/citizen/data"
      }

      config {
        image        = "ghcr.io/outsideris/citizen:0.5.2"
        ports        = ["citizen"]
      }

      resources {
        cpu        = 128
        memory     = 128
        memory_max = 1024
      }

      volume_mount {
        volume      = "citizen"
        destination = "/citizen/data"
      }

      restart {
        attempts = 3
        interval = "5m"
        delay    = "2m"
        mode     = "delay"
      }

    }

    update {
      max_parallel     = 1
      health_check     = "checks"
      min_healthy_time = "5s"
      healthy_deadline = "30s"
      auto_revert      = true
      canary           = 0
    }
  }
}

type = "service"

network {
  port "citizen" {
    to = 3000
  }
}

env {
  CITIZEN_DATABASE_TYPE = "sqlite"
  CITIZEN_DATABASE_URL = "/citizen/data"
  CITIZEN_STORAGE = "file"
  CITIZEN_STORAGE_PATH = "/citizen/data"
}

...
  restart {
    attempts = 3
    interval = "5m"
    delay    = "2m"
    mode     = "delay"
  }

}

update {
  max_parallel     = 1
  health_check     = "checks"
  min_healthy_time = "5s"
  healthy_deadline = "30s"
  auto_revert      = true
  canary           = 0
}

job "redis" {
  datacenters = ["dc1"]
  priority    = 55

  type = "service"

  update {
    max_parallel     = 1
    min_healthy_time = "10s"
    healthy_deadline = "3m"
    auto_revert      = false
    canary           = 0
  }

  group "cache" {
    count = 1

    restart {
      attempts = 10
      interval = "5m"
      delay    = "25s"
      mode     = "delay"
    }

    ephemeral_disk {
      size = 300
    }

    network {
      port "redis" {
        to = 6379
      }
    }

    service {
      provider = "nomad"
      tags = ["redis", "cache"]
      port = "redis"

      check {
        name     = "redis"
        type     = "tcp"
        interval = "10s"
        timeout  = "1s"
      }
    }

    task "redis" {
      driver = "docker"
      config {
        image = "redis:7.0.11-alpine3.18"
        ports = ["redis"]

        labels {
          app     = "discourse"
          service = "cache"
        }
      }

      resources {
        cpu        = 500
        memory     = 128
        memory_max = 256
      }
    }
  }
}

config {
  image   = "postgres:15.3-alpine3.18"
  ports   = ["postgresql"]
  volumes = [
    "local/bootstrap.sql:/docker-entrypoint-initdb.d/bootstrap.sql",
  ]
}

template {
  data = <<EOF
{{ with secret "my/vault/path" }}
CREATE DATABASE discourse;
CREATE USER discourse WITH ENCRYPTED PASSWORD '{{ .Data.data.discourse }}';
GRANT ALL PRIVILEGES ON DATABASE discourse TO discourse;
ALTER DATABASE discourse OWNER TO discourse;
GRANT ALL ON schema public TO discourse;
{{ end }}
EOF
  destination = "local/bootstrap.sql"
}

job "postgres" {
  datacenters = ["dc1"]
  type        = "service"
  priority    = 60

  group "database" {
    count = 1

    volume "data" {
      type      = "host"
      source    = "postgresql"
      read_only = false
    }

    network {
      port "postgresql" {
        to = 5432
      }
    }

    service {
      provider = "nomad"
      tags = ["postgresql", "database"]
      port = "postgresql"

      check {
        name     = "postgres"
        type     = "tcp"
        interval = "10s"
        timeout  = "2s"
      }
    }

    task "postgres" {
      driver = "docker"

      vault {
        policies = ["nomad-postgres"]
      }

      config {
        image   = "postgres:15.3-alpine3.18"
        ports   = ["postgresql"]
        volumes = [
          "local/bootstrap.sql:/docker-entrypoint-initdb.d/bootstrap.sql",
        ]
      }

      template {
        data = <<EOF
{{ with secret "my/vault/path" }}
CREATE DATABASE discourse;
CREATE USER discourse WITH ENCRYPTED PASSWORD '{{ .Data.data.discourse }}';
GRANT ALL PRIVILEGES ON DATABASE discourse TO discourse;
ALTER DATABASE discourse OWNER TO discourse;
GRANT ALL ON schema public TO discourse;
{{ end }}
EOF
        destination = "local/bootstrap.sql"
      }

      template {
        data = <<EOF
{{ with secret "my/vault/path" }}
POSTGRES_USER=root
POSTGRES_PASSWORD="{{ .Data.data.root }}"
{{ end }}
EOF
        destination = "secret/file.env"
        env         = true
      }

      logs {
        max_files     = 5
        max_file_size = 15
      }

      resources {
        cpu        = 500
        memory     = 256
        memory_max = 512
      }

      volume_mount {
        volume      = "data"
        destination = "/var/lib/postgresql/data"
      }
    }
  }
}

{{- range nomadService "postgres-database" }}
DISCOURSE_DATABASE_HOST="{{ .Address}}"
DISCOURSE_DATABASE_PORT_NUMBER="{{ .Port }}"
{{ end -}}
{{- range nomadService "redis-cache" }}
DISCOURSE_REDIS_HOST="{{ .Address}}"
DISCOURSE_REDIS_PORT_NUMBER="{{ .Port }}"
{{ end -}}

job "discourse" {
  datacenters = ["dc1"]
  type = "service"

  group "discourse" {
    count = 1

    vault {
      policies = ["nomad-postgres", "apps"]
    }

    volume "discourse" {
      type      = "host"
      source    = "discourse"
      read_only = false
    }

    network {
      port "discourse" {
        to = 3000
      }
    }

    service {
      provider = "nomad"
      tags = [
        "discourse", "app",
        "traefik.enable=true",
        "traefik.http.routers.discourse.rule=(Host(`discourse.p0l.io`) && ClientIP(`1.2.3.4`))",
        "traefik.http.routers.discourse.tls=true",
        "traefik.http.routers.discourse.tls.certresolver=route53"
      ]
      port = "discourse"

      check {
        type     = "http"
        name     = "rails"
        path     = "/srv/status"
        interval = "10s"
        timeout  = "5s"
      }

      check_restart {
        limit = 3
        grace = "10m"
      }
    }

    task "sidekiq" {
      driver = "docker"

      config {
        image   = "bitnami/discourse:3.0.4"
        command = "/opt/bitnami/scripts/discourse-sidekiq/run.sh"
      }

      env {
        # Apps
        DISCOURSE_HOST         = "discourse.p0l.io"
        DISCOURSE_ENABLE_HTTPS = "no"
        DISCOURSE_ENV          = "production"
        # Database
        DISCOURSE_DATABASE_NAME = "discourse"
        DISCOURSE_DATABASE_USER = "discourse"
        # Redis
        ALLOW_EMPTY_PASSWORD = "yes"
      }

      template {
        data = <<EOH
{{ with secret "my/vault/path" }}
DISCOURSE_EMAIL="{{ .Data.data.mail }}"
DISCOURSE_USERNAME="{{ .Data.data.name }}"
DISCOURSE_PASSWORD="{{ .Data.data.password }}"
{{ end -}}
{{ with secret "my/vault/path" }}
DISCOURSE_DATABASE_PASSWORD="{{ .Data.data.discourse }}"
{{ end }}
{{- range nomadService "postgres-database" }}
DISCOURSE_DATABASE_HOST="{{ .Address}}"
DISCOURSE_DATABASE_PORT_NUMBER="{{ .Port }}"
{{ end -}}
{{- range nomadService "redis-cache" }}
DISCOURSE_REDIS_HOST="{{ .Address}}"
DISCOURSE_REDIS_PORT_NUMBER="{{ .Port }}"
{{ end -}}
EOH
        destination = "secrets/file.env"
        env         = true
     }

      volume_mount {
        volume      = "discourse"
        destination = "/bitnami/discourse"
      }

      resources {
        cpu        = 250
        memory     = 512
        memory_max = 1024
      }
    }

    task "rails" {
      driver = "docker"

      env {
        BITNAMI_DEBUG = "true"
        # Apps
        DISCOURSE_PRECOMPILE_ASSETS = "no"
        DISCOURSE_HOST              = "discourse.p0l.io"
        DISCOURSE_ENABLE_HTTPS      = "no"
        DISCOURSE_ENV               = "production"
        # Database
        DISCOURSE_DATABASE_NAME = "discourse"
        DISCOURSE_DATABASE_USER = "discourse"
        # Redis
        ALLOW_EMPTY_PASSWORD = "yes"
      }


      template {
        data = <<EOH
{{ with secret "my/vault/path" }}
DISCOURSE_EMAIL="{{ .Data.data.mail }}"
DISCOURSE_USERNAME="{{ .Data.data.name }}"
DISCOURSE_PASSWORD="{{ .Data.data.password }}"
{{ end -}}
{{ with secret "my/vault/path" }}
DISCOURSE_DATABASE_PASSWORD="{{ .Data.data.discourse }}"
{{ end -}}
{{- range nomadService "postgres-database" }}
DISCOURSE_DATABASE_HOST="{{ .Address}}"
DISCOURSE_DATABASE_PORT_NUMBER="{{ .Port }}"
{{ end -}}
{{- range nomadService "redis-cache" }}
DISCOURSE_REDIS_HOST="{{ .Address}}"
DISCOURSE_REDIS_PORT_NUMBER="{{ .Port }}"
{{ end -}}
EOH
        destination = "secrets/file.env"
        env         = true
      }

      config {
        image        = "bitnami/discourse:3.0.4"
        ports        = ["discourse"]
      }

      resources {
        cpu    = 800
        memory = 512
      }

      volume_mount {
        volume      = "discourse"
        destination = "/bitnami/discourse"
      }

      restart {
        attempts = 3
        interval = "1m"
        delay    = "2m"
        mode     = "delay"
      }
    }

    update {
      max_parallel     = 1
      min_healthy_time = "5s"
      healthy_deadline = "5m"
      auto_revert      = false
      canary           = 0
    }
  }
}