version: '3.8'
services:

  traefik:
    image: "traefik:latest"
    container_name: "traefik"
    restart: unless-stopped
    command:
      - "--accesslog=false"
      - "--providers.docker=true"
      - "--providers.docker.exposedbydefault=false"
      - "--entrypoints.websecure.address=:443"
      - "--entrypoints.web.address=:80"
      - "--entrypoints.web.http.redirections.entrypoint.to=websecure"
      - "--entrypoints.web.http.redirections.entrypoint.scheme=https"
      - "--certificatesresolvers.selfhostedservices.acme.tlschallenge=true"
      - "--certificatesresolvers.selfhostedservices.acme.email=${EMAIL}"
      - "--certificatesresolvers.selfhostedservices.acme.storage=/letsencrypt/acme.json"
      - "--api.insecure=true"
      - "--api.dashboard=true"
      - "--providers.docker"
      - "--log.level=INFO"
    ports:
      - target: 80
        published: 80
        mode: host
      - target: 443
        published: 443
        mode: host
      - target: 8080
        published: 8080
        mode: host
    volumes:
      - "./letsencrypt:/letsencrypt"
      - "/var/run/docker.sock:/var/run/docker.sock:ro"

  ditto-docker:
    container_name: ditto-docker
    image: pastagringo/ditto-docker
    environment:
      - ADMIN_HEX_KEY=${ADMIN_HEX_KEY}
      - SENTRY_DSN=${SENTRY_DSN}
    volumes:
       - ditto_data:/app
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.ditto-docker.rule=Host(`${DITTO_DOMAIN}`)"
      - "traefik.http.services.ditto-docker.loadbalancer.server.port=8000"
      - "traefik.http.routers.ditto-docker.entrypoints=websecure"
      - "traefik.http.routers.ditto-docker.tls.certresolver=selfhostedservices"
      - "traefik.http.middlewares.accesscontrol.headers.customResponseHeaders.access-control-allow-origin=*"
      - "traefik.http.routers.ditto-docker.middlewares=accesscontrol@docker"

volumes:
  ditto_data: