services:
  traefik:
    image: traefik:v3.7@sha256:6b9cbca6fac42ab0075f5437d8dc1685cfd188626d8d515839ea94f8b6271c42
    container_name: traefik
    restart: unless-stopped
    security_opt:
      - no-new-privileges:true
    command:
      - --api.dashboard=true
      - --api.insecure=false
      - --ping=true
      - --providers.docker=true
      - --providers.docker.exposedbydefault=false
      - --providers.docker.network=frontend_net
      - --providers.file.directory=/dynamic
      - --providers.file.watch=true
      - --entrypoints.web.address=:80
      - --entrypoints.web.http.redirections.entrypoint.to=websecure
      - --entrypoints.web.http.redirections.entrypoint.scheme=https
      - --entrypoints.web.http.redirections.entrypoint.permanent=true
      - --entrypoints.websecure.address=:443
      - --entrypoints.websecure.http.tls=true
      - --entrypoints.metrics.address=:8082
      - --metrics.prometheus=true
      - --metrics.prometheus.entrypoint=metrics
      - --metrics.prometheus.addentrypointslabels=true
      - --metrics.prometheus.addrouterslabels=true
      - --metrics.prometheus.addserviceslabels=true
      - --certificatesresolvers.le.acme.email=mi.kaleschke@gmx.de
      - --certificatesresolvers.le.acme.storage=/letsencrypt/acme.json
      - --certificatesresolvers.le.acme.dnschallenge=true
      - --certificatesresolvers.le.acme.dnschallenge.provider=cloudflare
      - --accesslog=true
      - --log.level=INFO
    environment:
      - CF_DNS_API_TOKEN_FILE=/run/secrets/cloudflare_dns_api_token
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - /mnt/user/appdata/traefik/dynamic:/dynamic:ro
      - /mnt/user/appdata/traefik/letsencrypt:/letsencrypt
    secrets:
      - cloudflare_dns_api_token
    networks:
      - frontend_net
      - backend_net
      - monitoring_net
    healthcheck:
      test: ["CMD", "traefik", "healthcheck", "--ping"]
      interval: 30s
      timeout: 5s
      retries: 3
      start_period: 30s
    labels:
      - traefik.enable=true
      - traefik.docker.network=frontend_net
      - traefik.http.routers.traefik.rule=Host(`traefik.kaleschke.info`)
      - traefik.http.routers.traefik.entrypoints=websecure
      - traefik.http.routers.traefik.tls=true
      - traefik.http.routers.traefik.tls.certresolver=le
      - traefik.http.routers.traefik.service=api@internal
      - traefik.http.routers.traefik.middlewares=authelia@file,secure-headers@file
     
    dns:
      - 1.1.1.1
      - 8.8.8.8

networks:
  frontend_net:
    external: true
  backend_net:
    external: true
  monitoring_net:
    external: true

secrets:
  cloudflare_dns_api_token:
    file: /mnt/user/appdata/traefik/secrets/cloudflare_dns_api_token