lastlegion / container-patterns-with-nomad Goto Github PK

job "ssl-proxy" {
  datacenters=["mydc"]
  group "ssl-proxy" {
        
    network {
        port "http" {
            static = 8080
        }
        port "https" {
            static = 8015
        }
    }

    service {
      name = "app-server"
      port = "http"

      check {
        type     = "http"
        port     = "http"
        path     = "/"
        interval = "2s"
        timeout  = "2s"
      }
    }

    task "app-server" {
      driver = "docker"

      config {
        image = "hashicorp/http-echo:latest"
        ports = [
          "http",
        ]
        args  = [
          "-listen", ":${NOMAD_PORT_http}",
          "-text", "Hello World!",
        ]
      }
    }

    task "ssl-proxy-sidecar" {
      driver = "docker"
      config {
        image = "nginx"
        ports = [
          "https",
        ]
        volumes = [
          "config/nginx.conf:/etc/nginx/nginx.conf",
          "secrets/certificate.crt:/secrets/certificate.crt",
          "secrets/certificate.key:/secrets/certificate.key",
        ]
      }
      
      template {
        data = <<EOF
          worker_processes  1;
          events {
              worker_connections  1024;
          }
          http {
              include       mime.types;
              default_type  application/octet-stream;
              sendfile        on;
              keepalive_timeout  65;
              upstream backend {
                {{ range service "app-server" }}
                server {{ .Address }}:{{ .Port }};
                {{ else }}server 127.0.0.1:65535; # force a 502
                {{ end }}
              }
              server {
                listen       8015 ssl;
                server_name  localhost;
                ssl_certificate      /secrets/certificate.crt;
                ssl_certificate_key  /secrets/certificate.key;
                location / {
                  proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
                  proxy_set_header Host $http_host;
                  proxy_pass http://backend;
                }
              }
          }
        EOF
        destination = "config/nginx.conf"
      }
      template {
        # Warning: Fetch certificate from a secret store like vault in a production setting
        data = <<EOF
-----BEGIN CERTIFICATE-----
MIIDajCCAlKgAwIBAgITPAgZrdQO2jRhM/KkR8Czc1iC+jANBgkqhkiG9w0BAQsF
...
jlw8JveeVvRFTvdwW23+JHnTvqpremm5PhmvPPnRNOhR1WhKxvJWWdeYDBjBoaPo
vAIDwNat6MpbCNH6pSs=
-----END CERTIFICATE-----
        EOF
        destination = "secrets/certificate.crt"
      }
      template {
        # Warning: Fetch certificate from a secret store like vault in a production setting
        data = <<EOF
-----BEGIN PRIVATE KEY-----
MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQDtReLnMCGfM6jI
...
EFG7bYgACbS289cpWA2nmcfhhGn7tV26xLuMFma0GQhr6jpQbuqONbrnlyRJGvMr
7iyk7nrNu9Ez3yM9zVMuvIJH
-----END PRIVATE KEY-----
        EOF
        destination = "secrets/certificate.key"
      }
    }
  }
}