networks:
  traefik:
    name: traefik
    external: true

# https://hub.docker.com/_/traefik

services:
  traefik:
    image: traefik:${TRAEFIK_DOCKER_TAG:-v3} # replace with traefik:latest if you are feeling frisky
    container_name: ${TRAEFIK_CONTAINER_NAME:-traefik}
    restart: ${TRAEFIK_RESTART:-unless-stopped}
    mem_limit: ${TRAEFIK_MEM_LIMIT:-100m}
    networks:
      - traefik
    extra_hosts:
      - host.docker.internal:172.17.0.1
    ports:
      - 80:80
      - 443:443
    env_file:
      - services-enabled/.env
      - services-enabled/.env.external
    volumes:
      - ./etc/traefik/letsencrypt:/letsencrypt
      - ./external-enabled:/enabled
      - /etc/localtime:/etc/localtime:ro
      - /usr/share/zoneinfo:/usr/share/zoneinfo:ro
      - /var/run/docker.sock:/var/run/docker.sock:ro
    command:
      - --api
      - --api.insecure=${TRAEFIK_API_INSECURE:-true}
      - --api.dashboard=${TRAEFIK_DASHBOARD_ENABLE:-true}
      - --log.level=${TRAEFIK_LOG_LEVEL:-DEBUG}
      - --accesslog=${TRAEFIK_ACCESSLOG:-true}
      - --entryPoints.metrics.address=:8082
      - --metrics.prometheus.entryPoint=metrics
      - --providers.docker
      - --providers.file.watch=true
      - --providers.file.directory=/enabled
      - --entrypoints.web.address=:80
      - --entrypoints.websecure.address=:443
      - --entrypoints.websecure.http.middlewares=default-headers@file
      - --entrypoints.web.http.redirections.entrypoint.to=websecure
      - --entrypoints.web.http.redirections.entrypoint.scheme=https
      - --entrypoints.websecure.http.tls=true
      - --entrypoints.websecure.http.tls.certResolver=letsencrypt
      - --entrypoints.websecure.http.tls.domains[0].main=${HOST_DOMAIN}
      - --entrypoints.websecure.http.tls.domains[0].sans=*.${HOST_DOMAIN}
      - --serverstransport.insecureskipverify=true
      - --certificatesresolvers.letsencrypt.acme.dnschallenge=true
      - --certificatesresolvers.letsencrypt.acme.dnschallenge.provider=${DNS_CHALLENGE_PROVIDER:-cloudflare}
      - --certificatesresolvers.letsencrypt.acme.email=${DNS_CHALLENGE_API_EMAIL:-${CF_API_EMAIL}}
      - --certificatesresolvers.letsencrypt.acme.storage=/letsencrypt/acme.json
      - --certificatesResolvers.letsencrypt.acme.dnsChallenge.delayBeforeCheck=${CF_RESOLVER_WAITTIME:-120}
      - --certificatesresolvers.letsencrypt.acme.dnschallenge.resolvers=1.1.1.1:53,1.0.0.1:53
      - --certificatesresolvers.letsencrypt.acme.caserver=${ACME_CASERVER:-https://acme-v02.api.letsencrypt.org/directory}
    labels:
      - joyride.host.name=${HOST_NAME}.${HOST_DOMAIN}
      - traefik.http.routers.traefik.rule=Host(`${HOST_NAME}.${HOST_DOMAIN}`)  && (PathPrefix(`/traefik`) || PathPrefix(`/api`))
      - traefik.http.routers.traefik.middlewares=traefik_strip
      - traefik.http.middlewares.traefik_strip.stripprefix.prefixes=/traefik
      - traefik.enable=true
      - traefik.http.routers.traefik.entrypoints=websecure
      - traefik.http.routers.traefik.service=api@internal
      - traefik.http.routers.traefik.rule=Host(`${HOST_NAME}.${HOST_DOMAIN}`)
      # https://doc.traefik.io/traefik/operations/dashboard/#insecure-mode
      # insecure mode is incompatible with the custom API base path option.
      # we will need to use a custom override if you want the dashboard behind authentication