---
services:
  traefik:
    image: docker.io/library/traefik:v3.6.15
    security_opt:
      - no-new-privileges:true
    command:
      - "--global.checkNewVersion=false"
      - "--global.sendAnonymousUsage=false"
      <%- if container_loglevel %>
      - "--log.level=<< container_loglevel >>"
      <%- endif %>
      - "--ping=true"
      - "--ping.entryPoint=ping"
      <%- if accesslog_enabled %>
      - "--accesslog=true"
      <%- endif %>
      <%- if dashboard_enabled %>
      - "--api.dashboard=true"
      - "--api.insecure=true"
      <%- endif %>
      <%- if prometheus_enabled %>
      - "--metrics.prometheus=true"
      - "--metrics.prometheus.entryPoint=metrics"
      - "--metrics.prometheus.addRoutersLabels=true"
      <%- endif %>
      - "--entrypoints.ping.address=:8082"
      <%- if prometheus_enabled %>
      - "--entrypoints.metrics.address=:9090"
      <%- endif %>
      - "--entrypoints.web.address=:80"
      - "--entrypoints.web.http.encodedCharacters.allowEncodedSlash=true"
      <%- if traefik_tls_enabled and traefik_tls_redirect %>
      - "--entrypoints.web.http.redirections.entryPoint.to=websecure"
      - "--entrypoints.web.http.redirections.entryPoint.scheme=https"
      <%- endif %>
      <%- if traefik_tls_enabled %>
      - "--entrypoints.websecure.address=:443"
      - "--entrypoints.websecure.http.encodedCharacters.allowEncodedSlash=true"
      - "--certificatesresolvers.<< traefik_tls_certresolver >>.acme.email=<< traefik_tls_acme_email >>"
      - "--certificatesresolvers.<< traefik_tls_certresolver >>.acme.caServer=https://acme-v02.api.letsencrypt.org/directory"
      - "--certificatesresolvers.<< traefik_tls_certresolver >>.acme.storage=/var/traefik/certs/acme.json"
      - "--certificatesresolvers.<< traefik_tls_certresolver >>.acme.dnsChallenge.provider=<< traefik_tls_certresolver >>"
      - "--certificatesresolvers.<< traefik_tls_certresolver >>.acme.dnsChallenge.resolvers=1.1.1.1:53,8.8.8.8:53"
      <%- endif %>
      <%- if traefik_tls_secure_ciphers %>
      - "--tls.options.default.cipherSuites=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256"
      <%- endif %>
      <%- if traefik_tls_skipverify %>
      - "--serversTransport.insecureSkipVerify=true"
      <%- endif %>
      - "--providers.docker=true"
      - "--providers.docker.exposedByDefault=false"
      - "--providers.docker.network=<< traefik_network >>"
    ports:
      - "<< ports_http >>:80"
      - "<< ports_https >>:443"
      <%- if dashboard_enabled %>
      - "<< ports_dashboard >>:8080"
      <%- endif %>
    
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
      <%- if volume_mode == 'mount' %>
      - << volume_mount_path >>:/var/traefik/certs/:rw
      <%- elif volume_mode == 'local' or volume_mode == 'nfs' %>
      - traefik_certs:/var/traefik/certs/:rw
      <%- endif %>
    environment:
      - TZ=<< container_timezone >>
      <%- if traefik_tls_enabled %>
      <%- if traefik_tls_certresolver == 'cloudflare' %>
      - CF_DNS_API_TOKEN=${CF_DNS_API_TOKEN}
      <%- elif traefik_tls_certresolver == 'porkbun' %>
      - PORKBUN_API_KEY=${PORKBUN_API_KEY}
      - PORKBUN_SECRET_API_KEY=${PORKBUN_SECRET_API_KEY}
      <%- elif traefik_tls_certresolver == 'route53' %>
      - AWS_ACCESS_KEY_ID=${AWS_ACCESS_KEY_ID}
      - AWS_SECRET_ACCESS_KEY=${AWS_SECRET_ACCESS_KEY}
      - AWS_REGION=<< traefik_tls_acme_region >>
      <%- elif traefik_tls_certresolver == 'digitalocean' %>
      - DO_AUTH_TOKEN=${DO_AUTH_TOKEN}
      <%- elif traefik_tls_certresolver == 'godaddy' %>
      - GODADDY_API_KEY=${GODADDY_API_KEY}
      - GODADDY_API_SECRET=${GODADDY_API_SECRET}
      <%- elif traefik_tls_certresolver == 'azure' %>
      - AZURE_CLIENT_ID=${AZURE_CLIENT_ID}
      - AZURE_CLIENT_SECRET=${AZURE_CLIENT_SECRET}
      - AZURE_TENANT_ID=<< traefik_tls_acme_tenant_id >>
      - AZURE_SUBSCRIPTION_ID=<< traefik_tls_acme_subscription_id >>
      - AZURE_RESOURCE_GROUP=<< traefik_tls_acme_resource_group >>
      <%- elif traefik_tls_certresolver == 'namecheap' %>
      - NAMECHEAP_API_KEY=${NAMECHEAP_API_KEY}
      - NAMECHEAP_API_USER=${NAMECHEAP_API_USER}
      <%- elif traefik_tls_certresolver == 'netcup' %>
      - NETCUP_CUSTOMER_NUMBER=${NETCUP_CUSTOMER_NUMBER}
      - NETCUP_API_KEY=${NETCUP_API_KEY}
      - NETCUP_API_PASSWORD=${NETCUP_API_PASSWORD}
      <%- elif traefik_tls_certresolver == 'ovh' %>
      - OVH_ENDPOINT=<< traefik_tls_acme_endpoint >>
      - OVH_APPLICATION_KEY=${OVH_APPLICATION_KEY}
      - OVH_APPLICATION_SECRET=${OVH_APPLICATION_SECRET}
      - OVH_CONSUMER_KEY=${OVH_CONSUMER_KEY}
      <%- endif %>
      <%- endif %>
    healthcheck:
      test: ["CMD", "wget", "--spider", "-q", "http://127.0.0.1:8082/ping"]
      interval: 30s
      timeout: 5s
      retries: 3
      start_period: 10s
    networks:
      - << traefik_network >>
    restart: << restart_policy >>


networks:
  << traefik_network >>:
    <%- if traefik_network_external %>
    external: true
    <%- else %>
    driver: bridge
    name: << traefik_network >>
    <%- endif %>


<%- if volume_mode == 'local' %>
volumes:
  traefik_certs:
    driver: local
<%- elif volume_mode == 'nfs' %>
volumes:
  traefik_certs:
    driver: local
    driver_opts:
      type: nfs
      o: addr=<< volume_nfs_server >>,nfsvers=4,<< volume_nfs_options >>
      device: ":<< volume_nfs_path >>"
<%- endif %>