docker-compose.yml

networks:
  traefik:
    name: traefik

# https://hub.docker.com/_/traefik

services:
  traefik:
    image: traefik:${TRAEFIK_DOCKER_TAG:-2.10} # replace with traefik:latest if you are feeling frisky
    container_name: ${TRAEFIK_CONTAINER_NAME:-traefik}
    restart: ${TRAEFIK_RESTART:-unless-stopped}
    mem_limit: ${TRAEFIK_MEM_LIMIT:-100m}
    networks:
      - traefik
    extra_hosts:
      - host.docker.internal:172.17.0.1
    ports:
      - 80:80
      - 443:443
    env_file:
      - .env
    volumes:
      - ./etc/traefik/letsencrypt:/letsencrypt
      - ./etc/traefik/enabled:/enabled
      - /etc/localtime:/etc/localtime:ro
      - /usr/share/zoneinfo:/usr/share/zoneinfo:ro
      - /var/run/docker.sock:/var/run/docker.sock:ro
    command:
      - --api
      - --api.dashboard=${TRAEFIK_DASHBOARD_ENABLE:-true}
      - --log.level=${TRAEFIK_LOG_LEVEL:-ERROR}
      - --accesslog=${TRAEFIK_ACCESSLOG:-false}
      - --entryPoints.metrics.address=:8082
      - --metrics.prometheus.entryPoint=metrics
      - --providers.docker
      - --providers.file.watch=true
      - --providers.file.directory=/enabled
      # - --providers.docker.allowEmptyServices=true
      # - --experimental.plugins.sablier.moduleName=github.com/acouvreur/sablier
      # - --experimental.plugins.sablier.version=v1.6.0
      - --entrypoints.web.address=:80
      - --entrypoints.websecure.address=:443
      - --entrypoints.web.http.redirections.entrypoint.to=websecure
      - --entrypoints.web.http.redirections.entrypoint.scheme=https
      - --entrypoints.websecure.http.tls=true
      - --entrypoints.websecure.http.tls.certResolver=letsencrypt
      - --entrypoints.websecure.http.tls.domains[0].main=${HOST_DOMAIN}
      - --entrypoints.websecure.http.tls.domains[0].sans=*.${HOST_DOMAIN}
      - --serverstransport.insecureskipverify=true
      - --certificatesresolvers.letsencrypt.acme.dnschallenge=true
      - --certificatesresolvers.letsencrypt.acme.dnschallenge.provider=${DNS_CHALLENGE_PROVIDER:-cloudflare}
      - --certificatesresolvers.letsencrypt.acme.email=${DNS_CHALLENGE_API_EMAIL}
      - --certificatesresolvers.letsencrypt.acme.storage=/letsencrypt/acme.json
      - --certificatesResolvers.letsencrypt.acme.dnsChallenge.delayBeforeCheck=${CF_RESOLVER_WAITTIME:-60}
      - --certificatesresolvers.letsencrypt.acme.dnschallenge.resolvers=1.1.1.1:53,1.0.0.1:53
      - --certificatesresolvers.letsencrypt.acme.caserver=${ACME_CASERVER:-https://acme-v02.api.letsencrypt.org/directory}
    labels:
      - joyride.host.name=${HOST_NAME}.${HOST_DOMAIN}
      - traefik.enable=true
      - traefik.http.routers.traefik.entrypoints=websecure
      - traefik.http.routers.traefik.service=api@internal
      #- traefik.http.routers.traefik.rule=Host(`traefik.${HOST_DOMAIN}`)
      # comment the following three(3) lines if using the rule=Host line above
      - traefik.http.routers.traefik.rule=Host(`${HOST_NAME}.${HOST_DOMAIN}`)  && (PathPrefix(`/traefik`) || PathPrefix(`/api`))
      - traefik.http.routers.traefik.middlewares=traefik_strip
      - traefik.http.middlewares.traefik_strip.stripprefix.prefixes=/traefik