services:
  traefik:
    image: traefik:v3.5
    container_name: traefik
    restart: unless-stopped
    command:
      # API
      - "--api.insecure=false"
      - "--api.dashboard=true"

      # Providers
      - "--providers.docker=true"
      - "--providers.docker.exposedbydefault=false"
      - "--providers.docker.network=traefik-proxy"
      - "--providers.file.directory=/etc/traefik/dynamic"
      - "--providers.file.watch=true"

      # EntryPoints
      - "--entryPoints.web.address=:80"
      - "--entryPoints.websecure.address=:443"
      - "--entryPoints.websecure.http.tls=true"
      - "--entryPoints.web.http.redirections.entryPoint.to=websecure"
      - "--entryPoints.web.http.redirections.entryPoint.scheme=https"
      - "--entryPoints.ssh.address=:2221"

      # Let's Encrypt STAGING. CURRENTLY USING CF ORIGIN CA INSTEAD
      # - "--certificatesresolvers.letsencrypt.acme.email=${EMAIL}"
      # - "--certificatesresolvers.letsencrypt.acme.storage=/letsencrypt/acme.json"
      # - "--certificatesresolvers.letsencrypt.acme.caserver=https://acme-staging-v02.api.letsencrypt.org/directory"
      # - "--certificatesresolvers.letsencrypt.acme.httpchallenge=true"
      # - "--certificatesresolvers.letsencrypt.acme.httpchallenge.entrypoint=web"

      # Cloudflare 
      - "--entryPoints.web.forwardedHeaders.trustedIPs=173.245.48.0/20,103.21.244.0/22,103.22.200.0/22,103.31.4.0/22,141.101.64.0/18,108.162.192.0/18,190.93.240.0/20,188.114.96.0/20,197.234.240.0/22,198.41.128.0/17,162.158.0.0/15,104.16.0.0/13,104.24.0.0/14,172.64.0.0/13,131.0.72.0/22"
      - "--entryPoints.websecure.forwardedHeaders.trustedIPs=173.245.48.0/20,103.21.244.0/22,103.22.200.0/22,103.31.4.0/22,141.101.64.0/18,108.162.192.0/18,190.93.240.0/20,188.114.96.0/20,197.234.240.0/22,198.41.128.0/17,162.158.0.0/15,104.16.0.0/13,104.24.0.0/14,172.64.0.0/13,131.0.72.0/22"

      # Logging
      - "--log.level=INFO"
      - "--log.filePath=/var/log/traefik/traefik.log"
      - "--accesslog=true"
      - "--accesslog.filepath=/var/log/traefik/access.log"

      - "traefik.enable=true"
      - "traefik.docker.network=traefik-proxy"

      # Prod Router (Dashboard) - DISABLED per user request
      # - "traefik.http.routers.traefik-dashboard.rule=Host(`traefik.forust.xyz`)"
      # - "traefik.http.routers.traefik-dashboard.entrypoints=websecure"
      # - "traefik.http.routers.traefik-dashboard.middlewares=auth,security-headers"
      # - "traefik.http.routers.traefik-dashboard.service=api@internal"
      # - "traefik.http.routers.traefik-dashboard.tls=true"

      # Local Router
      - "traefik.http.routers.traefik-dashboard-local.rule=Host(`traefik.workstation.internal`) || Host(`traefik.internal`)"
      - "traefik.http.routers.traefik-dashboard-local.entrypoints=websecure"
      - "traefik.http.routers.traefik-dashboard-local.middlewares=auth,security-headers"
      - "traefik.http.routers.traefik-dashboard-local.service=api@internal"
      - "traefik.http.routers.traefik-dashboard-local.tls=true"

      # Dev Router
      - "traefik.http.routers.traefik-dashboard-dev.rule=Host(`traefik.gigaforust.internal`)"
      - "traefik.http.routers.traefik-dashboard-dev.entrypoints=websecure"
      - "traefik.http.routers.traefik-dashboard-dev.middlewares=security-headers"
      - "traefik.http.routers.traefik-dashboard-dev.service=api@internal"
      - "traefik.http.routers.traefik-dashboard-dev.tls=true"

      - glance.name=Traefik
      - glance.url=https://traefik.forust.xyz/
      - glance.description=Traefik is a modern reverse proxy and load balancer

    ports:
      - "80:80"
      - "443:443"

    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - ./dynamic:/etc/traefik/dynamic:ro
      - ./certs:/certs:ro
      - ./logs:/var/log/traefik
      # - ./traefik/letsencrypt:/letsencrypt

    networks:
      - traefik-proxy

    environment:
      - TZ=Europe/Bratislava

networks:
  traefik-proxy:
    external: true