Implement Traefik provider for Nomad orchestrator

2022-06-10 11:32:08 -05:00 · 2022-06-10 11:32:08 -05:00 · aa0b5466a9
commit aa0b5466a9
parent becee5e393
23 changed files with 4328 additions and 7 deletions
--- a/docs/content/assets/img/providers/nomad.png
+++ b/docs/content/assets/img/providers/nomad.png
--- a/docs/content/providers/nomad.md
+++ b/docs/content/providers/nomad.md
@ -0,0 +1,544 @@
+---
+title: "Nomad Service Discovery"
+description: "Learn how to use Nomad as a provider for configuration discovery in Traefik Proxy. Read the technical documentation."
+---
+
+# Traefik & Nomad Service Discovery
+
+A Story of Tags, Services & Nomads
+{: .subtitle }
+
+![Nomad Service Discovery](../assets/img/providers/nomad.png)
+
+Attach tags to your Nomad services and let Traefik do the rest!
+
+## Configuration Examples
+
+??? example "Configuring Nomad & Deploying Services"
+
+    Enabling the nomad provider
+
+    ```yaml tab="File (YAML)"
+    providers:
+      nomad: {}
+    ```
+
+    ```toml tab="File (TOML)"
+    [providers.nomad]
+    ```
+
+    ```bash tab="CLI"
+    --providers.nomad=true
+    ```
+
+    Attaching tags to services:
+
+    ```
+    ...
+    service {
+      name = "myService"
+      tags = [
+        "traefik.http.routers.my-router.rule=Host(`example.com`)",
+      ]
+    }
+    ...
+    ```
+
+## Routing Configuration
+
+See the dedicated section in [routing](../routing/providers/nomad.md).
+
+## Provider Configuration
+
+### `refreshInterval`
+
+_Optional, Default=15s_
+
+Defines the polling interval.
+
+```yaml tab="File (YAML)"
+providers:
+  nomad:
+    refreshInterval: 30s
+    # ...
+```
+
+```toml tab="File (TOML)"
+[providers.nomad]
+  refreshInterval = "30s"
+  # ...
+```
+
+```bash tab="CLI"
+--providers.nomad.refreshInterval=30s
+# ...
+```
+
+### `prefix`
+
+_required, Default="traefik"_
+
+The prefix for Nomad service tags defining Traefik labels.
+
+```yaml tab="File (YAML)"
+providers:
+  nomad:
+    prefix: test
+    # ...
+```
+
+```toml tab="File (TOML)"
+[providers.nomad]
+  prefix = "test"
+  # ...
+```
+
+```bash tab="CLI"
+--providers.nomad.prefix=test
+# ...
+```
+
+### `stale`
+
+_Optional, Default=false_
+
+Use stale consistency for Nomad service API reads.
+
+!!! note ""
+
+    This makes reads very fast and scalable at the cost of a higher likelihood of stale values.
+
+    For more information, see the Nomad [documentation on consistency](https://www.nomadproject.io/api-docs#consistency-modes).
+
+```yaml tab="File (YAML)"
+providers:
+  nomad:
+    stale: true
+    # ...
+```
+
+```toml tab="File (TOML)"
+[providers.nomad]
+  stale = true
+  # ...
+```
+
+```bash tab="CLI"
+--providers.nomad.stale=true
+# ...
+```
+
+### `endpoint`
+
+Defines the Nomad server endpoint.
+
+#### `address`
+
+Defines the address of the Nomad server.
+
+_Optional, Default="http://127.0.0.1:4646"_
+
+```yaml tab="File (YAML)"
+providers:
+  nomad:
+    endpoint:
+      address: http://127.0.0.1:4646
+    # ...
+```
+
+```toml tab="File (TOML)"
+[providers.nomad]
+  [providers.nomad.endpoint]
+    address = "http://127.0.0.1:4646"
+    # ...
+```
+
+```bash tab="CLI"
+--providers.nomad.endpoint.address=http://127.0.0.1:4646
+# ...
+```
+
+#### `datacenter`
+
+_Optional, Default=""_
+
+Defines the datacenter to use.
+If not provided in Traefik, Nomad uses the agent datacenter.
+
+```yaml tab="File (YAML)"
+providers:
+  nomad:
+    endpoint:
+      datacenter: dc1
+    # ...
+```
+
+```toml tab="File (TOML)"
+[providers.nomad]
+  [providers.nomad.endpoint]
+    datacenter = "dc1"
+    # ...
+```
+
+```bash tab="CLI"
+--providers.nomad.endpoint.datacenter=dc1
+# ...
+```
+
+#### `token`
+
+_Optional, Default=""_
+
+Token is used to provide a per-request ACL token, if Nomad ACLs are enabled.
+
+```yaml tab="File (YAML)"
+providers:
+  nomad:
+    endpoint:
+      token: test
+    # ...
+```
+
+```toml tab="File (TOML)"
+[providers.nomad]
+  [providers.nomad.endpoint]
+    token = "test"
+    # ...
+```
+
+```bash tab="CLI"
+--providers.nomad.endpoint.token=test
+# ...
+```
+
+#### `endpointWaitTime`
+
+_Optional, Default=""_
+
+Limits the duration for which a Watch can block.
+If not provided, the agent default values will be used.
+
+```yaml tab="File (YAML)"
+providers:
+  nomad:
+    endpoint:
+      endpointWaitTime: 15s
+    # ...
+```
+
+```toml tab="File (TOML)"
+[providers.nomad]
+  [providers.nomad.endpoint]
+    endpointWaitTime = "15s"
+    # ...
+```
+
+```bash tab="CLI"
+--providers.nomad.endpoint.endpointwaittime=15s
+# ...
+```
+
+#### `httpAuth`
+
+_Optional_
+
+Used to authenticate the HTTP client using HTTP Basic Authentication.
+
+##### `username`
+
+_Optional, Default=""_
+
+Username to use for HTTP Basic Authentication.
+
+```yaml tab="File (YAML)"
+providers:
+  nomad:
+    endpoint:
+      httpAuth:
+        username: admin
+```
+
+```toml tab="File (TOML)"
+[providers.nomad.endpoint.httpAuth]
+  username = "admin"
+```
+
+```bash tab="CLI"
+--providers.nomad.endpoint.httpauth.username=admin
+```
+
+##### `password`
+
+_Optional, Default=""_
+
+Password to use for HTTP Basic Authentication.
+
+```yaml tab="File (YAML)"
+providers:
+  nomad:
+    endpoint:
+      httpAuth:
+        password: passw0rd
+```
+
+```toml tab="File (TOML)"
+[providers.nomad.endpoint.httpAuth]
+  password = "passw0rd"
+```
+
+```bash tab="CLI"
+--providers.nomad.endpoint.httpauth.password=passw0rd
+```
+
+#### `tls`
+
+_Optional_
+
+Defines the TLS configuration used for the secure connection to the Nomad API.
+
+##### `ca`
+
+_Optional_
+
+`ca` is the path to the certificate authority used for the secure connection to Nomad,
+it defaults to the system bundle.
+
+```yaml tab="File (YAML)"
+providers:
+  nomad:
+    endpoint:
+      tls:
+        ca: path/to/ca.crt
+```
+
+```toml tab="File (TOML)"
+[providers.nomad.endpoint.tls]
+  ca = "path/to/ca.crt"
+```
+
+```bash tab="CLI"
+--providers.nomad.endpoint.tls.ca=path/to/ca.crt
+```
+
+##### `cert`
+
+_Optional_
+
+`cert` is the path to the public certificate used for the secure connection to the Nomad API.
+When using this option, setting the `key` option is required.
+
+```yaml tab="File (YAML)"
+providers:
+  nomad:
+    endpoint:
+      tls:
+        cert: path/to/foo.cert
+        key: path/to/foo.key
+```
+
+```toml tab="File (TOML)"
+[providers.nomad.endpoint.tls]
+  cert = "path/to/foo.cert"
+  key = "path/to/foo.key"
+```
+
+```bash tab="CLI"
+--providers.nomad.endpoint.tls.cert=path/to/foo.cert
+--providers.nomad.endpoint.tls.key=path/to/foo.key
+```
+
+##### `key`
+
+_Optional_
+
+`key` is the path to the private key used for the secure connection to the Nomad API.
+When using this option, setting the `cert` option is required.
+
+```yaml tab="File (YAML)"
+providers:
+  nomad:
+    endpoint:
+      tls:
+        cert: path/to/foo.cert
+        key: path/to/foo.key
+```
+
+```toml tab="File (TOML)"
+[providers.nomad.endpoint.tls]
+  cert = "path/to/foo.cert"
+  key = "path/to/foo.key"
+```
+
+```bash tab="CLI"
+--providers.nomad.endpoint.tls.cert=path/to/foo.cert
+--providers.nomad.endpoint.tls.key=path/to/foo.key
+```
+
+##### `insecureSkipVerify`
+
+_Optional, Default=false_
+
+If `insecureSkipVerify` is `true`, the TLS connection to Nomad accepts any certificate presented by the server regardless of the hostnames it covers.
+
+```yaml tab="File (YAML)"
+providers:
+  nomad:
+    endpoint:
+      tls:
+        insecureSkipVerify: true
+```
+
+```toml tab="File (TOML)"
+[providers.nomad.endpoint.tls]
+  insecureSkipVerify = true
+```
+
+```bash tab="CLI"
+--providers.nomad.endpoint.tls.insecureskipverify=true
+```
+
+### `exposedByDefault`
+
+_Optional, Default=true_
+
+Expose Nomad services by default in Traefik.
+If set to `false`, services that do not have a `traefik.enable=true` tag will be ignored from the resulting routing configuration.
+
+For additional information, refer to [Restrict the Scope of Service Discovery](./overview.md#restrict-the-scope-of-service-discovery).
+
+```yaml tab="File (YAML)"
+providers:
+  nomad:
+    exposedByDefault: false
+    # ...
+```
+
+```toml tab="File (TOML)"
+[providers.nomad]
+  exposedByDefault = false
+  # ...
+```
+
+```bash tab="CLI"
+--providers.nomad.exposedByDefault=false
+# ...
+```
+
+### `defaultRule`
+
+_Optional, Default=```Host(`{{ normalize .Name }}`)```_
+
+The default host rule for all services.
+
+For a given service, if no routing rule was defined by a tag, it is defined by this `defaultRule` instead.
+The `defaultRule` must be set to a valid [Go template](https://pkg.go.dev/text/template/),
+and can include [sprig template functions](https://masterminds.github.io/sprig/).
+The service name can be accessed with the `Name` identifier,
+and the template has access to all the labels (i.e. tags beginning with the `prefix`) defined on this service.
+
+The option can be overridden on an instance basis with the `traefik.http.routers.{name-of-your-choice}.rule` tag.
+
+```yaml tab="File (YAML)"
+providers:
+  nomad:
+    defaultRule: "Host(`{{ .Name }}.{{ index .Labels \"customLabel\"}}`)"
+    # ...
+```
+
+```toml tab="File (TOML)"
+[providers.nomad]
+  defaultRule = "Host(`{{ .Name }}.{{ index .Labels \"customLabel\"}}`)"
+  # ...
+```
+
+```bash tab="CLI"
+--providers.nomad.defaultRule="Host(`{{ .Name }}.{{ index .Labels \"customLabel\"}}`)"
+# ...
+```
+
+### `constraints`
+
+_Optional, Default=""_
+
+The `constraints` option can be set to an expression that Traefik matches against the service tags to determine whether
+to create any route for that service. If none of the service tags match the expression, no route for that service is
+created. If the expression is empty, all detected services are included.
+
+The expression syntax is based on the ```Tag(`tag`)```, and ```TagRegex(`tag`)``` functions,
+as well as the usual boolean logic, as shown in examples below.
+
+??? example "Constraints Expression Examples"
+
+    ```toml
+    # Includes only services having the tag `a.tag.name=foo`
+    constraints = "Tag(`a.tag.name=foo`)"
+    ```
+
+    ```toml
+    # Excludes services having any tag `a.tag.name=foo`
+    constraints = "!Tag(`a.tag.name=foo`)"
+    ```
+
+    ```toml
+    # With logical AND.
+    constraints = "Tag(`a.tag.name`) && Tag(`another.tag.name`)"
+    ```
+
+    ```toml
+    # With logical OR.
+    constraints = "Tag(`a.tag.name`) || Tag(`another.tag.name`)"
+    ```
+
+    ```toml
+    # With logical AND and OR, with precedence set by parentheses.
+    constraints = "Tag(`a.tag.name`) && (Tag(`another.tag.name`) || Tag(`yet.another.tag.name`))"
+    ```
+
+    ```toml
+    # Includes only services having a tag matching the `a\.tag\.t.+` regular expression.
+    constraints = "TagRegex(`a\.tag\.t.+`)"
+    ```
+
+```yaml tab="File (YAML)"
+providers:
+  nomad:
+    constraints: "Tag(`a.tag.name`)"
+    # ...
+```
+
+```toml tab="File (TOML)"
+[providers.nomad]
+  constraints = "Tag(`a.tag.name`)"
+  # ...
+```
+
+```bash tab="CLI"
+--providers.nomad.constraints="Tag(`a.tag.name`)"
+# ...
+```
+
+For additional information, refer to [Restrict the Scope of Service Discovery](./overview.md#restrict-the-scope-of-service-discovery).
+
+### `namespace`
+
+_Optional, Default=""_
+
+The `namespace` option defines the namespace in which the Nomad services will be discovered.
+
+```yaml tab="File (YAML)"
+providers:
+  nomad:
+    namespace: "production"
+    # ...
+```
+
+```toml tab="File (TOML)"
+[providers.nomad]
+  namespace = "production"
+  # ...
+```
+
+```bash tab="CLI"
+--providers.nomad.namespace=production
+# ...
+```
--- a/docs/content/providers/overview.md
+++ b/docs/content/providers/overview.md
@ -139,6 +139,7 @@ Below is the list of the currently supported providers in Traefik.
 | [Kubernetes Ingress](./kubernetes-ingress.md)     | Orchestrator | Ingress              | `kubernetes`        |
 | [Kubernetes Gateway API](./kubernetes-gateway.md) | Orchestrator | Gateway API Resource | `kubernetesgateway` |
 | [Consul Catalog](./consul-catalog.md)             | Orchestrator | Label                | `consulcatalog`     |
+| [Nomad](./nomad.md)                               | Orchestrator | Label                | `nomad`             |
 | [ECS](./ecs.md)                                   | Orchestrator | Label                | `ecs`               |
 | [Marathon](./marathon.md)                         | Orchestrator | Label                | `marathon`          |
 | [Rancher](./rancher.md)                           | Orchestrator | Label                | `rancher`           |
@ -213,6 +214,7 @@ List of providers that support these features:

 - [Docker](./docker.md#exposedbydefault)
 - [Consul Catalog](./consul-catalog.md#exposedbydefault)
+- [Nomad](./nomad.md#exposedbydefault)
 - [Rancher](./rancher.md#exposedbydefault)
 - [Marathon](./marathon.md#exposedbydefault)

@ -222,6 +224,7 @@ List of providers that support constraints:

 - [Docker](./docker.md#constraints)
 - [Consul Catalog](./consul-catalog.md#constraints)
+- [Nomad](./nomad.md#constraints)
 - [Rancher](./rancher.md#constraints)
 - [Marathon](./marathon.md#constraints)
 - [Kubernetes CRD](./kubernetes-crd.md#labelselector)
--- a/docs/content/reference/dynamic-configuration/nomad.md
+++ b/docs/content/reference/dynamic-configuration/nomad.md
@ -0,0 +1,16 @@
+---
+title: "Traefik Nomad Service Discovery Configuration Documentation"
+description: "View the reference for performing dynamic configurations with Traefik Proxy and Nomad Service Discovery. Read the technical documentation."
+---
+
+# Nomad Service Discovery Configuration Reference
+
+Dynamic configuration with Nomad Service Discovery
+{: .subtitle }
+
+The labels are case insensitive.
+
+```yaml
+--8<-- "content/reference/dynamic-configuration/nomad.yml"
+--8<-- "content/reference/dynamic-configuration/docker-labels.yml"
+```
--- a/docs/content/reference/dynamic-configuration/nomad.yml
+++ b/docs/content/reference/dynamic-configuration/nomad.yml
@ -0,0 +1 @@
+- "traefik.enable=true"
--- a/docs/content/reference/static-configuration/cli-ref.md
+++ b/docs/content/reference/static-configuration/cli-ref.md
@ -822,6 +822,57 @@ Display additional provider logs. (Default: ```false```)
 `--providers.marathon.watch`:  
 Watch provider. (Default: ```true```)

+`--providers.nomad`:  
+Enable Nomad backend with default settings. (Default: ```false```)
+
+`--providers.nomad.constraints`:  
+Constraints is an expression that Traefik matches against the Nomad service's tags to determine whether to create route(s) for that service.
+
+`--providers.nomad.defaultrule`:  
+Default rule. (Default: ```Host(`{{ normalize .Name }}`)```)
+
+`--providers.nomad.endpoint.address`:  
+The address of the Nomad server, including scheme and port.
+
+`--providers.nomad.endpoint.endpointwaittime`:  
+WaitTime limits how long a Watch will block. If not provided, the agent default values will be used (Default: ```0```)
+
+`--providers.nomad.endpoint.region`:  
+Nomad region to use. If not provided, the local agent region is used.
+
+`--providers.nomad.endpoint.tls.ca`:  
+TLS CA
+
+`--providers.nomad.endpoint.tls.caoptional`:  
+TLS CA.Optional (Default: ```false```)
+
+`--providers.nomad.endpoint.tls.cert`:  
+TLS cert
+
+`--providers.nomad.endpoint.tls.insecureskipverify`:  
+TLS insecure skip verify (Default: ```false```)
+
+`--providers.nomad.endpoint.tls.key`:  
+TLS key
+
+`--providers.nomad.endpoint.token`:  
+Token is used to provide a per-request ACL token.
+
+`--providers.nomad.exposedbydefault`:  
+Expose Nomad services by default. (Default: ```true```)
+
+`--providers.nomad.namespace`:  
+Sets the Nomad namespace used to discover services.
+
+`--providers.nomad.prefix`:  
+Prefix for nomad service tags. (Default: ```traefik```)
+
+`--providers.nomad.refreshinterval`:  
+Interval for polling Nomad API. (Default: ```15```)
+
+`--providers.nomad.stale`:  
+Use stale consistency for catalog reads. (Default: ```false```)
+
 `--providers.plugin.<name>`:  
 Plugins configuration.

--- a/docs/content/reference/static-configuration/env-ref.md
+++ b/docs/content/reference/static-configuration/env-ref.md
@ -822,6 +822,57 @@ Display additional provider logs. (Default: ```false```)
 `TRAEFIK_PROVIDERS_MARATHON_WATCH`:  
 Watch provider. (Default: ```true```)

+`TRAEFIK_PROVIDERS_NOMAD`:  
+Enable Nomad backend with default settings. (Default: ```false```)
+
+`TRAEFIK_PROVIDERS_NOMAD_CONSTRAINTS`:  
+Constraints is an expression that Traefik matches against the Nomad service's tags to determine whether to create route(s) for that service.
+
+`TRAEFIK_PROVIDERS_NOMAD_DEFAULTRULE`:  
+Default rule. (Default: ```Host(`{{ normalize .Name }}`)```)
+
+`TRAEFIK_PROVIDERS_NOMAD_ENDPOINT_ADDRESS`:  
+The address of the Nomad server, including scheme and port.
+
+`TRAEFIK_PROVIDERS_NOMAD_ENDPOINT_ENDPOINTWAITTIME`:  
+WaitTime limits how long a Watch will block. If not provided, the agent default values will be used (Default: ```0```)
+
+`TRAEFIK_PROVIDERS_NOMAD_ENDPOINT_REGION`:  
+Nomad region to use. If not provided, the local agent region is used.
+
+`TRAEFIK_PROVIDERS_NOMAD_ENDPOINT_TLS_CA`:  
+TLS CA
+
+`TRAEFIK_PROVIDERS_NOMAD_ENDPOINT_TLS_CAOPTIONAL`:  
+TLS CA.Optional (Default: ```false```)
+
+`TRAEFIK_PROVIDERS_NOMAD_ENDPOINT_TLS_CERT`:  
+TLS cert
+
+`TRAEFIK_PROVIDERS_NOMAD_ENDPOINT_TLS_INSECURESKIPVERIFY`:  
+TLS insecure skip verify (Default: ```false```)
+
+`TRAEFIK_PROVIDERS_NOMAD_ENDPOINT_TLS_KEY`:  
+TLS key
+
+`TRAEFIK_PROVIDERS_NOMAD_ENDPOINT_TOKEN`:  
+Token is used to provide a per-request ACL token.
+
+`TRAEFIK_PROVIDERS_NOMAD_EXPOSEDBYDEFAULT`:  
+Expose Nomad services by default. (Default: ```true```)
+
+`TRAEFIK_PROVIDERS_NOMAD_NAMESPACE`:  
+Sets the Nomad namespace used to discover services.
+
+`TRAEFIK_PROVIDERS_NOMAD_PREFIX`:  
+Prefix for nomad service tags. (Default: ```traefik```)
+
+`TRAEFIK_PROVIDERS_NOMAD_REFRESHINTERVAL`:  
+Interval for polling Nomad API. (Default: ```15```)
+
+`TRAEFIK_PROVIDERS_NOMAD_STALE`:  
+Use stale consistency for catalog reads. (Default: ```false```)
+
 `TRAEFIK_PROVIDERS_PLUGIN_<NAME>`:  
 Plugins configuration.

--- a/docs/content/reference/static-configuration/file.toml
+++ b/docs/content/reference/static-configuration/file.toml
@ -174,6 +174,25 @@
      [providers.consulCatalog.endpoint.httpAuth]
        username = "foobar"
        password = "foobar"
+  [providers.nomad]
+    constraints = "foobar"
+    prefix = "foobar"
+    refreshInterval = "42s"
+    stale = true
+    exposedByDefault = true
+    defaultRule = "foobar"
+    namespace = "foobar"
+    [providers.nomad.endpoint]
+      address = "foobar"
+      region = "foobar"
+      token = "foobar"
+      endpointWaitTime = "42s"
+      [providers.nomad.endpoint.tls]
+        ca = "foobar"
+        caOptional = true
+        cert = "foobar"
+        key = "foobar"
+        insecureSkipVerify = true
  [providers.ecs]
    constraints = "foobar"
    exposedByDefault = true
--- a/docs/content/reference/static-configuration/file.yaml
+++ b/docs/content/reference/static-configuration/file.yaml
@ -188,6 +188,25 @@ providers:
      httpAuth:
        username: foobar
        password: foobar
+  nomad:
+    constraints: foobar
+    prefix: foobar
+    refreshInterval: 42s
+    stale: true
+    exposedByDefault: true
+    defaultRule: foobar
+    namespace: foobar
+    endpoint:
+      address: foobar
+      region: foobar
+      token: foobar
+      endpointWaitTime: 42s
+      tls:
+        ca: foobar
+        caOptional: true
+        cert: foobar
+        key: foobar
+        insecureSkipVerify: true
  ecs:
    constraints: foobar
    exposedByDefault: true
--- a/docs/content/routing/providers/consul-catalog.md
+++ b/docs/content/routing/providers/consul-catalog.md
@ -8,7 +8,7 @@ description: "Learn how to use Consul Catalog as a provider for routing configur
 A Story of Tags, Services & Instances
 {: .subtitle }

-![Rancher](../../assets/img/providers/consul.png)
+![Consul Catalog](../../assets/img/providers/consul.png)

 Attach tags to your services and let Traefik do the rest!

--- a/docs/content/routing/providers/nomad.md
+++ b/docs/content/routing/providers/nomad.md
@ -0,0 +1,466 @@
+---
+title: "Traefik Nomad Service Discovery Routing"
+description: "Learn how to use Nomad Service Discovery as a provider for routing configurations in Traefik Proxy. Read the technical documentation."
+---
+
+# Traefik and Nomad Service Discovery
+
+A story of Tags, Services & Nomads
+{: .subtitle }
+
+![Nomad](../../assets/img/providers/nomad.png)
+
+Attach tags to your Nomad services and let Traefik do the rest!
+
+## Routing Configuration
+
+!!! info "tags"
+
+    - tags are case insensitive.
+    - The complete list of tags can be found [the reference page](../../reference/dynamic-configuration/nomad.md)
+
+### General
+
+Traefik creates, for each Nomad service, a corresponding Traefik [service](../services/index.md) and [router](../routers/index.md).
+
+The Traefik service automatically gets a server per instance in this Nomad service, and the router gets a default rule attached to it, based on the Nomad service name.
+
+### Routers
+
+To update the configuration of the Router automatically attached to the service, add tags starting with `traefik.routers.{name-of-your-choice}.` and followed by the option you want to change.
+
+For example, to change the rule, you could add the tag ```traefik.http.routers.my-service.rule=Host(`example.com`)```.
+
+??? info "`traefik.http.routers.<router_name>.rule`"
+
+    See [rule](../routers/index.md#rule) for more information.
+
+    ```yaml
+    traefik.http.routers.myrouter.rule=Host(`example.com`)
+    ```
+
+??? info "`traefik.http.routers.<router_name>.entrypoints`"
+
+    See [entry points](../routers/index.md#entrypoints) for more information.
+
+    ```yaml
+    traefik.http.routers.myrouter.entrypoints=web,websecure
+    ```
+
+??? info "`traefik.http.routers.<router_name>.middlewares`"
+
+    See [middlewares](../routers/index.md#middlewares) and [middlewares overview](../../middlewares/overview.md) for more information.
+
+    ```yaml
+    traefik.http.routers.myrouter.middlewares=auth,prefix,cb
+    ```
+
+??? info "`traefik.http.routers.<router_name>.service`"
+
+    See [rule](../routers/index.md#service) for more information.
+
+    ```yaml
+    traefik.http.routers.myrouter.service=myservice
+    ```
+
+??? info "`traefik.http.routers.<router_name>.tls`"
+
+    See [tls](../routers/index.md#tls) for more information.
+
+    ```yaml
+    traefik.http.routers.myrouter.tls=true
+    ```
+
+??? info "`traefik.http.routers.<router_name>.tls.certresolver`"
+
+    See [certResolver](../routers/index.md#certresolver) for more information.
+
+    ```yaml
+    traefik.http.routers.myrouter.tls.certresolver=myresolver
+    ```
+
+??? info "`traefik.http.routers.<router_name>.tls.domains[n].main`"
+
+    See [domains](../routers/index.md#domains) for more information.
+
+    ```yaml
+    traefik.http.routers.myrouter.tls.domains[0].main=example.org
+    ```
+
+??? info "`traefik.http.routers.<router_name>.tls.domains[n].sans`"
+
+    See [domains](../routers/index.md#domains) for more information.
+
+    ```yaml
+    traefik.http.routers.myrouter.tls.domains[0].sans=test.example.org,dev.example.org
+    ```
+
+??? info "`traefik.http.routers.<router_name>.tls.options`"
+
+    See [options](../routers/index.md#options) for more information.
+
+    ```yaml
+    traefik.http.routers.myrouter.tls.options=foobar
+    ```
+
+??? info "`traefik.http.routers.<router_name>.priority`"
+
+    See [priority](../routers/index.md#priority) for more information.
+
+    ```yaml
+    traefik.http.routers.myrouter.priority=42
+    ```
+
+### Services
+
+To update the configuration of the Service automatically attached to the service,
+add tags starting with `traefik.http.services.{name-of-your-choice}.`, followed by the option you want to change.
+
+For example, to change the `passHostHeader` behavior,
+you'd add the tag `traefik.http.services.{name-of-your-choice}.loadbalancer.passhostheader=false`.
+
+??? info "`traefik.http.services.<service_name>.loadbalancer.server.port`"
+
+    Registers a port.
+    Useful when the service exposes multiples ports.
+
+    ```yaml
+    traefik.http.services.myservice.loadbalancer.server.port=8080
+    ```
+
+??? info "`traefik.http.services.<service_name>.loadbalancer.server.scheme`"
+
+    Overrides the default scheme.
+
+    ```yaml
+    traefik.http.services.myservice.loadbalancer.server.scheme=http
+    ```
+
+??? info "`traefik.http.services.<service_name>.loadbalancer.serverstransport`"
+
+    Allows to reference a ServersTransport resource that is defined either with the File provider or the Kubernetes CRD one.
+    See [serverstransport](../services/index.md#serverstransport) for more information.
+
+    ```yaml
+    traefik.http.services.myservice.loadbalancer.serverstransport=foobar@file
+    ```
+
+??? info "`traefik.http.services.<service_name>.loadbalancer.passhostheader`"
+
+    See [pass Host header](../services/index.md#pass-host-header) for more information.
+
+    ```yaml
+    traefik.http.services.myservice.loadbalancer.passhostheader=true
+    ```
+
+??? info "`traefik.http.services.<service_name>.loadbalancer.healthcheck.headers.<header_name>`"
+
+    See [health check](../services/index.md#health-check) for more information.
+
+    ```yaml
+    traefik.http.services.myservice.loadbalancer.healthcheck.headers.X-Foo=foobar
+    ```
+
+??? info "`traefik.http.services.<service_name>.loadbalancer.healthcheck.hostname`"
+
+    See [health check](../services/index.md#health-check) for more information.
+
+    ```yaml
+    traefik.http.services.myservice.loadbalancer.healthcheck.hostname=example.org
+    ```
+
+??? info "`traefik.http.services.<service_name>.loadbalancer.healthcheck.interval`"
+
+    See [health check](../services/index.md#health-check) for more information.
+
+    ```yaml
+    traefik.http.services.myservice.loadbalancer.healthcheck.interval=10
+    ```
+
+??? info "`traefik.http.services.<service_name>.loadbalancer.healthcheck.path`"
+
+    See [health check](../services/index.md#health-check) for more information.
+
+    ```yaml
+    traefik.http.services.myservice.loadbalancer.healthcheck.path=/foo
+    ```
+
+??? info "`traefik.http.services.<service_name>.loadbalancer.healthcheck.port`"
+
+    See [health check](../services/index.md#health-check) for more information.
+
+    ```yaml
+    traefik.http.services.myservice.loadbalancer.healthcheck.port=42
+    ```
+
+??? info "`traefik.http.services.<service_name>.loadbalancer.healthcheck.scheme`"
+
+    See [health check](../services/index.md#health-check) for more information.
+
+    ```yaml
+    traefik.http.services.myservice.loadbalancer.healthcheck.scheme=http
+    ```
+
+??? info "`traefik.http.services.<service_name>.loadbalancer.healthcheck.timeout`"
+
+    See [health check](../services/index.md#health-check) for more information.
+
+    ```yaml
+    traefik.http.services.myservice.loadbalancer.healthcheck.timeout=10
+    ```
+
+??? info "`traefik.http.services.<service_name>.loadbalancer.healthcheck.followredirects`"
+
+    See [health check](../services/index.md#health-check) for more information.
+
+    ```yaml
+    traefik.http.services.myservice.loadbalancer.healthcheck.followredirects=true
+    ```
+
+??? info "`traefik.http.services.<service_name>.loadbalancer.sticky.cookie`"
+
+    See [sticky sessions](../services/index.md#sticky-sessions) for more information.
+
+    ```yaml
+    traefik.http.services.myservice.loadbalancer.sticky.cookie=true
+    ```
+
+??? info "`traefik.http.services.<service_name>.loadbalancer.sticky.cookie.httponly`"
+
+    See [sticky sessions](../services/index.md#sticky-sessions) for more information.
+
+    ```yaml
+    traefik.http.services.myservice.loadbalancer.sticky.cookie.httponly=true
+    ```
+
+??? info "`traefik.http.services.<service_name>.loadbalancer.sticky.cookie.name`"
+
+    See [sticky sessions](../services/index.md#sticky-sessions) for more information.
+
+    ```yaml
+    traefik.http.services.myservice.loadbalancer.sticky.cookie.name=foobar
+    ```
+
+??? info "`traefik.http.services.<service_name>.loadbalancer.sticky.cookie.secure`"
+
+    See [sticky sessions](../services/index.md#sticky-sessions) for more information.
+
+    ```yaml
+    traefik.http.services.myservice.loadbalancer.sticky.cookie.secure=true
+    ```
+
+??? info "`traefik.http.services.<service_name>.loadbalancer.sticky.cookie.samesite`"
+
+    See [sticky sessions](../services/index.md#sticky-sessions) for more information.
+
+    ```yaml
+    traefik.http.services.myservice.loadbalancer.sticky.cookie.samesite=none
+    ```
+
+??? info "`traefik.http.services.<service_name>.loadbalancer.responseforwarding.flushinterval`"
+
+    See [response forwarding](../services/index.md#response-forwarding) for more information.
+
+    ```yaml
+    traefik.http.services.myservice.loadbalancer.responseforwarding.flushinterval=10
+    ```
+
+### Middleware
+
+You can declare pieces of middleware using tags starting with `traefik.http.middlewares.{name-of-your-choice}.`, followed by the middleware type/options.
+
+For example, to declare a middleware [`redirectscheme`](../../middlewares/http/redirectscheme.md) named `my-redirect`, you'd write `traefik.http.middlewares.my-redirect.redirectscheme.scheme: https`.
+
+More information about available middlewares in the dedicated [middlewares section](../../middlewares/overview.md).
+
+??? example "Declaring and Referencing a Middleware"
+
+    ```yaml
+    # ...
+    # Declaring a middleware
+    traefik.http.middlewares.my-redirect.redirectscheme.scheme=https
+    # Referencing a middleware
+    traefik.http.routers.my-service.middlewares=my-redirect
+    ```
+
+!!! warning "Conflicts in Declaration"
+
+    If you declare multiple middleware with the same name but with different parameters, the middleware fails to be declared.
+
+### TCP
+
+You can declare TCP Routers and/or Services using tags.
+
+??? example "Declaring TCP Routers and Services"
+
+    ```yaml
+    traefik.tcp.routers.my-router.rule=HostSNI(`example.com`)
+    traefik.tcp.routers.my-router.tls=true
+    traefik.tcp.services.my-service.loadbalancer.server.port=4123
+    ```
+
+!!! warning "TCP and HTTP"
+
+    If you declare a TCP Router/Service, it will prevent Traefik from automatically creating an HTTP Router/Service (like it does by default if no TCP Router/Service is defined).
+    You can declare both a TCP Router/Service and an HTTP Router/Service for the same Nomad service (but you have to do so manually).
+
+#### TCP Routers
+
+??? info "`traefik.tcp.routers.<router_name>.entrypoints`"
+
+    See [entry points](../routers/index.md#entrypoints_1) for more information.
+
+    ```yaml
+    traefik.tcp.routers.mytcprouter.entrypoints=ep1,ep2
+    ```
+
+??? info "`traefik.tcp.routers.<router_name>.rule`"
+
+    See [rule](../routers/index.md#rule_1) for more information.
+
+    ```yaml
+    traefik.tcp.routers.mytcprouter.rule=HostSNI(`example.com`)
+    ```
+
+??? info "`traefik.tcp.routers.<router_name>.service`"
+
+    See [service](../routers/index.md#services) for more information.
+
+    ```yaml
+    traefik.tcp.routers.mytcprouter.service=myservice
+    ```
+
+??? info "`traefik.tcp.routers.<router_name>.tls`"
+
+    See [TLS](../routers/index.md#tls_1) for more information.
+
+    ```yaml
+    traefik.tcp.routers.mytcprouter.tls=true
+    ```
+
+??? info "`traefik.tcp.routers.<router_name>.tls.certresolver`"
+
+    See [certResolver](../routers/index.md#certresolver_1) for more information.
+
+    ```yaml
+    traefik.tcp.routers.mytcprouter.tls.certresolver=myresolver
+    ```
+
+??? info "`traefik.tcp.routers.<router_name>.tls.domains[n].main`"
+
+    See [domains](../routers/index.md#domains_1) for more information.
+
+    ```yaml
+    traefik.tcp.routers.mytcprouter.tls.domains[0].main=example.org
+    ```
+
+??? info "`traefik.tcp.routers.<router_name>.tls.domains[n].sans`"
+
+    See [domains](../routers/index.md#domains_1) for more information.
+
+    ```yaml
+    traefik.tcp.routers.mytcprouter.tls.domains[0].sans=test.example.org,dev.example.org
+    ```
+
+??? info "`traefik.tcp.routers.<router_name>.tls.options`"
+
+    See [options](../routers/index.md#options_1) for more information.
+
+    ```yaml
+    traefik.tcp.routers.mytcprouter.tls.options=myoptions
+    ```
+
+??? info "`traefik.tcp.routers.<router_name>.tls.passthrough`"
+
+    See [TLS](../routers/index.md#tls_1) for more information.
+
+    ```yaml
+    traefik.tcp.routers.mytcprouter.tls.passthrough=true
+    ```
+
+#### TCP Services
+
+??? info "`traefik.tcp.services.<service_name>.loadbalancer.server.port`"
+
+    Registers a port of the application.
+
+    ```yaml
+    traefik.tcp.services.mytcpservice.loadbalancer.server.port=423
+    ```
+
+??? info "`traefik.tcp.services.<service_name>.loadbalancer.terminationdelay`"
+
+    See [termination delay](../services/index.md#termination-delay) for more information.
+
+    ```yaml
+    traefik.tcp.services.mytcpservice.loadbalancer.terminationdelay=100
+    ```
+
+??? info "`traefik.tcp.services.<service_name>.loadbalancer.proxyprotocol.version`"
+
+    See [PROXY protocol](../services/index.md#proxy-protocol) for more information.
+
+    ```yaml
+    traefik.tcp.services.mytcpservice.loadbalancer.proxyprotocol.version=1
+    ```
+
+### UDP
+
+You can declare UDP Routers and/or Services using tags.
+
+??? example "Declaring UDP Routers and Services"
+
+    ```yaml
+    traefik.udp.routers.my-router.entrypoints=udp
+    traefik.udp.services.my-service.loadbalancer.server.port=4123
+    ```
+
+!!! warning "UDP and HTTP"
+
+    If you declare a UDP Router/Service, it will prevent Traefik from automatically creating an HTTP Router/Service (like it does by default if no UDP Router/Service is defined).
+    You can declare both a UDP Router/Service and an HTTP Router/Service for the same Nomad service (but you have to do so manually).
+
+#### UDP Routers
+
+??? info "`traefik.udp.routers.<router_name>.entrypoints`"
+
+    See [entry points](../routers/index.md#entrypoints_2) for more information.
+
+    ```yaml
+    traefik.udp.routers.myudprouter.entrypoints=ep1,ep2
+    ```
+
+??? info "`traefik.udp.routers.<router_name>.service`"
+
+    See [service](../routers/index.md#services_1) for more information.
+
+    ```yaml
+    traefik.udp.routers.myudprouter.service=myservice
+    ```
+
+#### UDP Services
+
+??? info "`traefik.udp.services.<service_name>.loadbalancer.server.port`"
+
+    Registers a port of the application.
+
+    ```yaml
+    traefik.udp.services.myudpservice.loadbalancer.server.port=423
+    ```
+
+### Specific Provider Options
+
+#### `traefik.enable`
+
+```yaml
+traefik.enable=true
+```
+
+You can tell Traefik to consider (or not) the service by setting `traefik.enable` to true or false.
+
+This option overrides the value of `exposedByDefault`.
+
+#### Port Lookup
+
+Traefik is capable of detecting the port to use, by following the default Nomad Service Discovery flow.
+That means, if you just expose lets say port `:1337` on the Nomad job, traefik will pick up this port and use it.
--- a/docs/mkdocs.yml
+++ b/docs/mkdocs.yml
@ -77,6 +77,7 @@ nav:
      - 'Kubernetes Ingress': 'providers/kubernetes-ingress.md'
      - 'Kubernetes Gateway API': 'providers/kubernetes-gateway.md'
      - 'Consul Catalog': 'providers/consul-catalog.md'
+      - 'Nomad': 'providers/nomad.md'
      - 'ECS': 'providers/ecs.md'
      - 'Marathon': 'providers/marathon.md'
      - 'Rancher': 'providers/rancher.md'
@ -97,6 +98,7 @@ nav:
          - 'Kubernetes Ingress': 'routing/providers/kubernetes-ingress.md'
          - 'Kubernetes Gateway API': 'routing/providers/kubernetes-gateway.md'
          - 'Consul Catalog': 'routing/providers/consul-catalog.md'
+          - 'Nomad': 'routing/providers/nomad.md'
          - 'ECS': 'routing/providers/ecs.md'
          - 'Marathon': 'routing/providers/marathon.md'
          - 'Rancher': 'routing/providers/rancher.md'
@ -194,6 +196,7 @@ nav:
        - 'Kubernetes CRD': 'reference/dynamic-configuration/kubernetes-crd.md'
        - 'Kubernetes Gateway API': 'reference/dynamic-configuration/kubernetes-gateway.md'
        - 'Consul Catalog': 'reference/dynamic-configuration/consul-catalog.md'
+        - 'Nomad': "reference/dynamic-configuration/nomad.md"
        - 'ECS': 'reference/dynamic-configuration/ecs.md'
        - 'KV': 'reference/dynamic-configuration/kv.md'
        - 'Marathon': 'reference/dynamic-configuration/marathon.md'