add prometheus

don't publish traefik api

roles/traefik/templates/docker-compose.yml.j2

@@ -13,6 +13,7 @@ services:
       - "443:443"
       - "80:80"
       - "{{ git_ssh_port }}:{{ git_ssh_port }}"
+      - "{{ traefik_api_port }}:{{ traefik_api_port }}"
     volumes:
       - /var/run/docker.sock:/var/run/docker.sock
       - {{ service_dir }}/traefik.toml:/etc/traefik/traefik.toml
@@ -29,10 +30,6 @@ services:
       - traefik.http.routers.esrom.tls=true
       - traefik.http.routers.esrom.tls.certresolver=geokunis
 
-      - traefik.http.routers.traefik.rule=Host(`traefik.pizzapim.nl`)
-      - traefik.http.routers.traefik.entrypoints=websecure
-      - traefik.http.routers.traefik.tls=true
-      - traefik.http.routers.traefik.tls.certresolver=pizzapim
+      - traefik.http.routers.traefik.rule=Host(`max.lan`)
+      - traefik.http.routers.traefik.entrypoints=internal
       - traefik.http.routers.traefik.service=api@internal
-      - traefik.http.routers.traefik.middlewares=whitelist-local
-      - "traefik.http.middlewares.whitelist-local.ipwhitelist.sourcerange=127.0.0.1/32,10.0.0.0/8,172.16.0.0/12,192.168.0.0/16,::1,fc00::/7"

roles/traefik/templates/traefik.toml.j2

@@ -13,11 +13,17 @@ loglevel = "DEBUG"
     address = ":{{ git_ssh_port }}"
   [entryPoints.video]
     address = ":{{ jitsi_videobridge_port }}/udp"
+  [entryPoints.internal]
+    address = ":{{ traefik_api_port }}"
 
 [api]
   insecure = false
   dashboard = true
 
+[metrics]
+  [metrics.prometheus]
+    entryPoint = "internal"
+
 [providers.docker]
   endpoint = "unix:///var/run/docker.sock"