services:
  traefik:
    container_name: traefik
    image: docker.io/library/traefik:v3.5.0
    restart: unless-stopped
    security_opt:
      - no-new-privileges:true
    secrets:
      - cf_api_token
    env_file: .env
    labels:
      - traefik.enable=true
      - traefik.http.routers.traefik.entrypoints=web
      - traefik.http.routers.traefik.rule=Host(`traefik.local.${DOMAIN_NAME}`)
      - traefik.http.middlewares.traefik-auth.basicauth.users=${TRAEFIK_DASHBOARD_CREDENTIALS}
      - traefik.http.middlewares.traefik-https-redirect.redirectscheme.scheme=https
      - traefik.http.middlewares.sslheader.headers.customrequestheaders.X-Forwarded-Proto=https
      - traefik.http.routers.traefik.middlewares=traefik-https-redirect
      - traefik.http.routers.traefik-secure.entrypoints=websecure
      - traefik.http.routers.traefik-secure.rule=Host(`traefik.local.${DOMAIN_NAME}`)
      - traefik.http.routers.traefik-secure.middlewares=traefik-auth
      - traefik.http.routers.traefik-secure.service=api@internal
    environment:
      - CF_DNS_API_TOKEN_FILE=/run/secrets/cf_api_token
      - TRAEFIK_DASHBOARD_CREDENTIALS=${TRAEFIK_DASHBOARD_CREDENTIALS}
    volumes:
      - ./data/traefik.yml:/traefik.yml:ro
      - ./data/acme.json:/acme.json # chmod 600
      - ./data/config.yml:/config.yml:ro
      - ./logs:/var/log/traefik
      - /etc/localtime:/etc/localtime:ro
      - /var/run/docker.sock:/var/run/docker.sock:ro
    ports:
      - 80:80
      - 81:81
      - 443:443
      - 443:443/udp
      - 444:444
      - 444:444/udp
    networks:
      - frontend

networks:
  frontend:
    external: true

secrets:
  cf_api_token:
    file: ./cf_api_token.txt