Two bastion hosts/lbs sharing a virtual IP (keepalived), with two Traefik instances each (private and public). I actually schedule them through Nomad (on the host network interfaces) as well - since they solved the host networking issue I mentioned above it's properly set up with service checks. Super smooth to add and change services with consul catalog, and ACME-TLS included.
Things I don't like that make me want to try envoy instead:
* It eats A LOT of CPU once number of peers ramp up - there's an issue on their GH that this seems to have been introduced in 2.1.
* UDP is completely broken. For the time being I'm doing per-job nginxes for that until I have a better solution.
* It's very brittle. Did you ever misspell the wrong thing in your label? If so you probably also wondered why half of your services all stopped working as Traefik arbitrarily let it hijack everything.
* The thing I metioned above with Consul Connect. Each service can integrate with either but not both.
It was great for months though, but I guess I grew out of it just by the time I started properly understanding how all the configuration actually works (:
