Nomad provider

Discovers Nomad services and emits Traefik configuration. Conceptually similar to the Consul Catalog provider, but driven by Nomad's own service registry (introduced in Nomad 1.3).

Source

pkg/provider/nomad/:

• nomad.go — provider definition.
• config.go — Nomad-tag → dynamic-configuration translation.
• nomad_test.go — table-driven mapping tests.

Configuration

providers:
  nomad:
    endpoint:
      address: http://nomad:4646
      token: <ACL token>
    refreshInterval: 15s
    exposedByDefault: false
    prefix: traefik
    namespaces: ['default']
    constraints: 'Tag(`production`)'

exposedByDefault: false means only services with traefik.enable=true in their tag list are picked up.

Tag conventions

Nomad services attach a tag list to each service block:

service {
  name = "web"
  port = "http"
  tags = [
    "traefik.enable=true",
    "traefik.http.routers.web.rule=Host(`web.example.com`)",
    "traefik.http.services.web.loadbalancer.server.port=8080",
  ]
}

Equivalent to Docker labels and Consul tags — the provider parses key-value pairs from =-separated tags.

How it works

The provider polls the Nomad services API every refreshInterval. Each service is mapped to a router/service pair with its task-allocated address and port.

graph LR
    Static --> Init[Init]
    Init --> Loop[poll loop]
    Loop -->|GET /v1/services| API[Nomad API]
    API --> Build[config.go: build dynamic.Configuration]
    Build --> Emit[send dynamic.Message]

For environments without service discovery, the provider can also read from Consul if Nomad's Consul integration is in use — the standalone Consul Catalog provider is preferred in that case.

Tests

• pkg/provider/nomad/config_test.go — tag → configuration mapping.
• pkg/provider/nomad/nomad_test.go — provider lifecycle.
• (No dedicated integration test — Nomad scenarios are covered by the unit tests with mocked clients.)

Practical notes

• ACL tokens with the read capability on the namespaces of interest are required when ACLs are enabled.
• The provider does not perform health-state filtering itself — it relies on Nomad to deregister unhealthy services.

For other orchestrators see Docker, Kubernetes, and ECS.