services:
  traefik_socket_proxy:
    container_name: traefik_socket_proxy
    image: ghcr.io/11notes/socket-proxy:2.1.3
    restart: unless-stopped
    read_only: true
    user: ${PUID}:${PGID}
    environment:
      TZ: ${TZ}
    volumes:
      - /run/docker.sock:/run/docker.sock:ro
      - socket-proxy:/run/proxy
    networks:
      - frontend

  traefik:
    container_name: traefik
    image: docker.io/library/traefik:v3.5.0
    restart: unless-stopped
    depends_on:
      traefik_socket_proxy:
        condition: service_healthy
    security_opt:
      - no-new-privileges:true
    secrets:
      - cf_api_token
    environment:
      - CF_DNS_API_TOKEN_FILE=/run/secrets/cf_api_token
    volumes:
      - ${APPDATA_PATH}/traefik/data/acme.json:/acme.json
      - ${APPDATA_PATH}/traefik/logs:/var/log/traefik
      - /etc/localtime:/etc/localtime:ro
      - socket-proxy:/var/run
    ports:
      - 80:80
      - 443:443
      - 443:443/udp
    networks:
      - frontend
    command:
      - --api.debug=true
      - --serversTransport.insecureSkipVerify=true

      # Entrypoints
      - --entrypoints.web.address=:80
      - --entrypoints.web.http.redirections.entrypoint.to=websecure
      - --entrypoints.web.http.redirections.entrypoint.scheme=https
      - --entrypoints.websecure.address=:443
      - --entrypoints.websecure.http.tls.certresolver=letsencrypt
      - --entrypoints.websecure.http.tls.domains[0].main=${DOMAIN}
      - --entrypoints.websecure.http.tls.domains[0].sans=*.${DOMAIN}

      # Providers
      - --providers.docker.endpoint=unix:///var/run/docker.sock
      - --providers.docker.exposedbydefault=false
      - --providers.docker.constraints=Label(`traefik-instance`,`${TRAEFIK_INSTANCE}`)

      # Certificates Resolvers
      - --certificatesresolvers.letsencrypt.acme.email=${EMAIL}
      - --certificatesresolvers.letsencrypt.acme.storage=acme.json
      - --certificatesresolvers.letsencrypt.acme.caserver=https://acme-v02.api.letsencrypt.org/directory
      - --certificatesresolvers.letsencrypt.acme.dnschallenge.provider=cloudflare
      - --certificatesresolvers.letsencrypt.acme.dnschallenge.resolvers=1.1.1.1:53,1.0.0.1:53

      # Log
      - --log.level=INFO
      - --log.filepath=/var/log/traefik/traefik.log
      - --log.maxsize=10
      - --log.maxbackups=5

      # Access Log
      - --accesslog.filepath=/var/log/traefik/access.log
      - --accesslog.fields.names.StartUTC=drop

networks:
  frontend:
    external: true

secrets:
  cf_api_token:
    file: ${APPDATA_PATH}/traefik/secrets/cf_api_token

volumes:
  socket-proxy: