version: "3.4"

services:
  traefik:
    image: "traefik:v3.2"
    
    ports:
      - target: 80
        published: 80
        mode: host
      - target: 443
        published: 443
        mode: host
    
    command:
      ### SWARM Provider (mitte docker!)
      - "--providers.swarm=true"
      - "--providers.swarm.endpoint=tcp://127.0.0.1:2375"  # HTTP endpoint
#      - "--providers.swarm.endpoint=unix:///var/run/docker.sock"
      - "--providers.swarm.exposedbydefault=false"
      - "--providers.swarm.network=my-traefik-network"
      
      ### File Provider
      - "--providers.file.filename=/letsencrypt/dynamic_conf.yml"
      
      ### Log Settings
      - "--log.level=DEBUG"
      - "--log"
      - "--accesslog"
      
      ### API Settings
      - "--api=true"
      - "--api.insecure=true"
      - "--api.dashboard=true"
      - "--api.debug=true"
      
      ### Entrypoints
      - "--entrypoints.web.address=:80"
      - "--entrypoints.websecure.address=:443"
      
      ### Let's Encrypt (DNS-01 Challenge)
      - "--certificatesResolvers.mychallenge.acme.dnschallenge=true"
      - "--certificatesResolvers.mychallenge.acme.dnschallenge.provider=digitalocean"
      - "--certificatesResolvers.mychallenge.acme.storage=/letsencrypt/acme.json"
      - "--certificatesResolvers.mychallenge.acme.email=ardo@odamus.com"
      
      ### Metrics
      - "--metrics.prometheus=true"
    
    environment:
      - "DO_AUTH_TOKEN=644121bb69116ae2dec66a50e97a7af3d464aa8a261330dedd7c030b064955ad"
    
    volumes:
      - "traefik_certs:/letsencrypt"
      - "/var/run/docker.sock:/var/run/docker.sock:ro"
      - "tmp:/tmp"
    
    networks:
      - traefik-network
      - traefik-external
    
    deploy:
      mode: replicated
      replicas: 1
      placement:
        constraints:
          - node.hostname == hetzner
          - node.role == manager
      labels:
        - "traefik.enable=true"
        
        ### HTTP-to-HTTPS redirect Middleware
        - "traefik.http.middlewares.http-to-https.redirectscheme.scheme=https"
        
        ### HTTP router
        - "traefik.http.routers.api.rule=Host(`traefik.odamus.com`)"
        - "traefik.http.routers.api.entrypoints=web"
        - "traefik.http.routers.api.service=api@internal"
        - "traefik.http.routers.api.middlewares=http-to-https"
        
        ### HTTPS router
        - "traefik.http.routers.api-secure.rule=Host(`traefik.odamus.com`)"
        - "traefik.http.routers.api-secure.entrypoints=websecure"
        - "traefik.http.routers.api-secure.service=api@internal"
        - "traefik.http.routers.api-secure.tls.certresolver=mychallenge"
        
        ### Basic Auth
        - "traefik.http.middlewares.traefik-auth.basicauth.users=ardo:$$apr1$$U6JrtDD/$$Z9U3bdtKCx2OvOaVNnAw80"
        - "traefik.http.routers.api-secure.middlewares=traefik-auth"
        
        ### Port
        - "traefik.http.services.traefik-svc.loadbalancer.server.port=8080"
    
    configs:
      - source: dynamic_conf
        target: /letsencrypt/dynamic_conf.yml

configs:
  dynamic_conf:
    file: ./config/dynamic_conf.yml

networks:
  traefik-network:
    external:
      name: traefik-network
  traefik-external:
    external:
      name: traefik-external

volumes:
  traefik_certs:
    external: true
  tmp: