version: "3.4"

### NB! First create "traefik-network" :) docker network.
### $ docker network create -d overlay traefik-network

services:

  traefik:
    image: "traefik:v2.11"
    ports:
      - target: 80
        published: 80
        mode: host
      - target: 443
        published: 443
        mode: host
#      - target: 8080
#        published: 8080
#        mode: host

    command:
      ### Log level: ERROR, DEBUG, PANIC, FATAL, WARN, INFO
      - "--log.level=DEBUG" 
      
      ### API Settings
#      - "--api.insecure=false" # <-- Not for production server !!!
      - "--api.insecure=true"
      - "--api.dashboard=true"
      - "--api.debug=true"

      ### Providers.Docker Settings 
      - "--providers.docker=true"
      - "--providers.docker.exposedbydefault=false" # don't expose all containers
      - "--providers.docker.network=my-traefik-network" # default traefik docker network for all exposed containers
      
      ### Entrypoints Settings
      - "--entrypoints.web.address=:80"
      - "--entrypoints.websecure.address=:443"

      ### Certificate Settings (Let's Encrypt -- DNS-01 challenge)
      - "--certificatesResolvers.mychallenge.acme.dnschallenge=true"
      - "--certificatesResolvers.mychallenge.acme.dnschallenge.provider=digitalocean"
      - "--certificatesResolvers.mychallenge.acme.storage=/letsencrypt/acme.json" 
      - "--certificatesResolvers.mychallenge.acme.email=ardo@odamus.com"

      ### Enable Prometheus metrics
      - "--metrics.prometheus=true"
      ### Enable the access log, with HTTP requests
      - "--accesslog"
      ### Enable the Traefik log, for configurations and errors
      - "--log"
      ### Enable the Dashboard and API
      - "--api"
      ### When exposing containers that are configured with host networking, 
      ### the IP address of the host is resolved as follows
#      - "--add-host=host.docker.internal:172.17.0.1"

      ### Docker Provider koos Swarm Mode'iga (v2 süntaks!)
      - "--providers.docker=true"
      - "--providers.docker.swarmMode=true"  # v2 jaoks
      - "--providers.docker.endpoint=unix:///var/run/docker.sock"
      - "--providers.docker.exposedbydefault=false"
      - "--providers.docker.network=my-traefik-network"
      
      ### File Provider
      - "--providers.file.filename=/letsencrypt/dynamic_conf.yml"
      - "--providers.file.watch=true"

#ardo
      # EEMALDA Docker/Swarm provider
      # Kasuta AINULT file provider





    environment:
      ### DigitalOcean API-KEY for DNS-01 challenge
      - "DO_AUTH_TOKEN=644121bb69116ae2dec66a50e97a7af3d464aa8a261330dedd7c030b064955ad"

    volumes:
      - "traefik_certs:/letsencrypt"   # Certs: DNS-01
      - "/var/run/docker.sock:/var/run/docker.sock:ro"
      - "tmp:/tmp"
#      - "./config/dynamic_conf.yml:/letsencrypt/new_dynamic_conf.yml"
#      - ./traefik.toml:/traefik.toml

    networks: 
      - traefik-network
      - traefik-external

    deploy:
      mode: replicated
      replicas: 1
      placement:
        constraints:
        - node.hostname == hetzner
        - node.role == manager

    labels:
      ### Create HTTP-to-HTTPS redirect Middleware
      - "traefik.http.middlewares.http-to-https.redirectscheme.scheme=https"
      ### Dashboard
      - "traefik.enable=true"
      ### HTTP-to-HTTPS Middleware attachment (if you want automatic redirection)
      - "traefik.http.routers.api.middlewares=http-to-https"
      # traefik.odamus.com
      ### HTTP router
      - "traefik.http.routers.api.rule=Host(`traefik.odamus.com`)"
      - "traefik.http.routers.api.entrypoints=web"
      - "traefik.http.routers.api.service=api@internal"
      ### HTTPS router
      - "traefik.http.routers.api-secure.rule=Host(`traefik.odamus.com`) && PathPrefix(`/api`, `/dashboard`)"
      - "traefik.http.routers.api-secure.entrypoints=websecure"
      - "traefik.http.routers.api-secure.service=api@internal"
      - "traefik.http.routers.api-secure.tls.certresolver=mychallenge"
      ### ardo
      ### Define the port inside of the Docker service to use
      - "traefik.http.services.traefik-network.loadbalancer.server.port=8080"
      ### Using the environment variables USERNAME and HASHED_PASSWORD
      - "traefik.http.middlewares.traefik-auth.basicauth.users=ardo:$$apr1$$U6JrtDD/$$Z9U3bdtKCx2OvOaVNnAw80"
      ### Enable HTTP Basic auth, using the middleware created above
      - "traefik.http.routers.api-secure.middlewares=traefik-auth"

    configs:
      - source: dynamic_conf
        target: /letsencrypt/dynamic_conf.yml
#        uid: '0'
#        gid: '0'
#        mode: 0440


configs:
  dynamic_conf:
    file: ./config/dynamic_conf.yml

### Networks used by this composition
networks: 
  traefik-network:
    external:
      name: traefik-network
  traefik-external:
    external:
      name: traefik-external

volumes:
#  traefik-data:
#    name: '{{.Service.Name}}-{{.Task.Slot}}-certs'
#    driver: local
  traefik_certs:
    external: true
  tmp: