---
services:
  << service_name >>:
    image: docker.io/library/traefik:v3.6.15
    command:
      - "--global.checkNewVersion=false"
      - "--global.sendAnonymousUsage=false"
      - "--log.level=<< container_loglevel >>"
      - "--ping=true"
      - "--ping.entryPoint=ping"
      <%- if accesslog_enabled %>
      - "--accesslog=true"
      <%- endif %>
      <%- if dashboard_enabled %>
      - "--api.dashboard=true"
      - "--api.insecure=true"
      <%- endif %>
      <%- if prometheus_enabled %>
      - "--metrics.prometheus=true"
      - "--metrics.prometheus.entryPoint=metrics"
      - "--metrics.prometheus.addRoutersLabels=true"
      <%- endif %>
      - "--entrypoints.ping.address=:8082"
      <%- if prometheus_enabled %>
      - "--entrypoints.metrics.address=:9090"
      <%- endif %>
      - "--entrypoints.web.address=:80"
      - "--entrypoints.web.http.encodedCharacters.allowEncodedSlash=true"
      <%- if traefik_tls_enabled and traefik_tls_redirect %>
      - "--entrypoints.web.http.redirections.entryPoint.to=websecure"
      - "--entrypoints.web.http.redirections.entryPoint.scheme=https"
      <%- endif %>
      <%- if traefik_tls_enabled %>
      - "--entrypoints.websecure.address=:443"
      - "--entrypoints.websecure.http.encodedCharacters.allowEncodedSlash=true"
      - "--certificatesresolvers.<< traefik_tls_certresolver >>.acme.email=<< traefik_tls_acme_email >>"
      - "--certificatesresolvers.<< traefik_tls_certresolver >>.acme.caServer=https://acme-v02.api.letsencrypt.org/directory"
      - "--certificatesresolvers.<< traefik_tls_certresolver >>.acme.storage=/var/traefik/certs/acme.json"
      - "--certificatesresolvers.<< traefik_tls_certresolver >>.acme.dnsChallenge.provider=<< traefik_tls_certresolver >>"
      - "--certificatesresolvers.<< traefik_tls_certresolver >>.acme.dnsChallenge.resolvers=1.1.1.1:53,8.8.8.8:53"
      - "--tls.options.default.minVersion=<< traefik_tls_min_version >>"
      <%- endif %>
      <%- if traefik_tls_secure_ciphers %>
      - "--tls.options.default.cipherSuites=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256"
      <%- endif %>
      <%- if traefik_tls_skipverify %>
      - "--serversTransport.insecureSkipVerify=true"
      <%- endif %>
      - "--providers.swarm.endpoint=unix:///var/run/docker.sock"
      - "--providers.swarm.exposedByDefault=false"
      - "--providers.swarm.network=<< traefik_network >>"
    ports:
      - target: 80
        published: << ports_http >>
        protocol: tcp
        mode: << ports_publish_mode >>
      - target: 443
        published: << ports_https >>
        protocol: tcp
        mode: << ports_publish_mode >>
      <%- if dashboard_enabled %>
      - target: 8080
        published: << ports_dashboard >>
        protocol: tcp
        mode: << ports_publish_mode >>
      <%- endif %>
      <%- if prometheus_enabled %>
      - target: 9090
        published: << ports_metrics >>
        protocol: tcp
        mode: << ports_publish_mode >>
      <%- endif %>
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
      <%- if volume_mode == 'mount' %>
      - << volume_mount_path >>:/var/traefik/certs:rw
      <%- elif volume_mode == 'local' or volume_mode == 'nfs' %>
      - << service_name >>_certs:/var/traefik/certs:rw
      <%- endif %>
    environment:
      - TZ=<< container_timezone >>
      <%- if traefik_tls_enabled %>
      <%- if traefik_tls_certresolver == 'cloudflare' %>
      - CF_DNS_API_TOKEN_FILE=/run/secrets/<< service_name >>_token
      <%- elif traefik_tls_certresolver == 'porkbun' %>
      - PORKBUN_API_KEY_FILE=/run/secrets/<< service_name >>_token
      - PORKBUN_SECRET_API_KEY_FILE=/run/secrets/<< service_name >>_token_key
      <%- elif traefik_tls_certresolver == 'route53' %>
      - AWS_SHARED_CREDENTIALS_FILE=/run/secrets/<< service_name >>_aws_credentials
      - AWS_REGION=<< traefik_tls_acme_region >>
      <%- elif traefik_tls_certresolver == 'digitalocean' %>
      - DO_AUTH_TOKEN_FILE=/run/secrets/<< service_name >>_token
      <%- elif traefik_tls_certresolver == 'godaddy' %>
      - GODADDY_API_KEY_FILE=/run/secrets/<< service_name >>_token
      - GODADDY_API_SECRET_FILE=/run/secrets/<< service_name >>_token_key
      <%- elif traefik_tls_certresolver == 'azure' %>
      - AZURE_CLIENT_ID_FILE=/run/secrets/<< service_name >>_token
      - AZURE_CLIENT_SECRET_FILE=/run/secrets/<< service_name >>_token_key
      - AZURE_TENANT_ID=<< traefik_tls_acme_tenant_id >>
      - AZURE_SUBSCRIPTION_ID=<< traefik_tls_acme_subscription_id >>
      - AZURE_RESOURCE_GROUP=<< traefik_tls_acme_resource_group >>
      <%- elif traefik_tls_certresolver == 'namecheap' %>
      - NAMECHEAP_API_KEY_FILE=/run/secrets/<< service_name >>_token
      - NAMECHEAP_API_USER=<< traefik_tls_acme_username >>
      <%- elif traefik_tls_certresolver == 'ovh' %>
      - OVH_ENDPOINT=<< traefik_tls_acme_endpoint >>
      - OVH_APPLICATION_KEY_FILE=/run/secrets/<< service_name >>_token
      - OVH_APPLICATION_SECRET_FILE=/run/secrets/<< service_name >>_token_key
      - OVH_CONSUMER_KEY_FILE=/run/secrets/<< service_name >>_consumer_key
      <%- endif %>
      <%- endif %>
    healthcheck:
      test: ["CMD", "wget", "--spider", "-q", "http://127.0.0.1:8082/ping"]
      interval: 30s
      timeout: 5s
      retries: 3
      start_period: 10s
    networks:
      - << traefik_network >>
    <%- if traefik_tls_enabled %>
    secrets:
      <%- if traefik_tls_certresolver == 'route53' %>
      - << service_name >>_aws_credentials
      <%- else %>
      - << service_name >>_token
      <%- if traefik_tls_certresolver == 'azure' or traefik_tls_certresolver == 'godaddy' or traefik_tls_certresolver == 'ovh' or traefik_tls_certresolver == 'porkbun' %>
      - << service_name >>_token_key
      <%- endif %>
      <%- if traefik_tls_certresolver == 'ovh' %>
      - << service_name >>_consumer_key
      <%- endif %>
      <%- endif %>
    <%- endif %>
    deploy:
      mode: << swarm_placement_mode >>
      <%- if swarm_placement_mode == 'replicated' %>
      replicas: << swarm_replicas >>
      <%- endif %>
      placement:
        constraints:
          - node.role == manager
          <%- if swarm_placement_host %>
          - node.hostname == << swarm_placement_host >>
          <%- endif %>
      restart_policy:
        condition: any

<%- if traefik_tls_enabled %>
secrets:
  <%- if traefik_tls_certresolver == 'route53' %>
  << service_name >>_aws_credentials:
    file: ./.env.secret.aws_credentials
  <%- else %>
  << service_name >>_token:
    file: ./.env.secret.token
  <%- if traefik_tls_certresolver == 'azure' or traefik_tls_certresolver == 'godaddy' or traefik_tls_certresolver == 'ovh' or traefik_tls_certresolver == 'porkbun' %>
  << service_name >>_token_key:
    file: ./.env.secret.token_key
  <%- endif %>
  <%- if traefik_tls_certresolver == 'ovh' %>
  << service_name >>_consumer_key:
    file: ./.env.secret.consumer_key
  <%- endif %>
  <%- endif %>
<%- endif %>

networks:
  << traefik_network >>:
    <%- if traefik_network_external %>
    external: true
    <%- else %>
    driver: overlay
    attachable: true
    name: << traefik_network >>
    <%- endif %>

<%- if volume_mode == 'local' %>
volumes:
  << service_name >>_certs:
    driver: local
<%- elif volume_mode == 'nfs' %>
volumes:
  << service_name >>_certs:
    driver: local
    driver_opts:
      type: nfs
      o: addr=<< volume_nfs_server >>,nfsvers=4,<< volume_nfs_options >>
      device: ":<< volume_nfs_path >>"
<%- endif %>