hetzner/server/portainer/portainer-agent-stack.yml

#version: '3.2'
#
services:

  agent:
    image: portainer/agent
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
      - /var/lib/docker/volumes:/var/lib/docker/volumes
    environment:
      AGENT_CLUSTER_ADDR: tasks.agent
    # ports on ardo lisatud
    ports:
      - target: 9001
        published: 9001
        protocol: tcp
        mode: host
    networks:
      agent_network:
      traefik-network:
    deploy:
      mode: global
      placement:
        constraints:
          - node.platform.os == linux
          #- node.hostname == swarm
          #- node.role == manager
          #- node.role == worker

  portainer:
    image: portainer/portainer-ce
    command: -H tcp://tasks.agent:9001 --tlsskipverify
#    command: --no-analytics
#    command: --ssl --sslcert /certs/portainer.crt --sslkey /certs/portainer.key
#    command: -H unix:///var/run/docker.sock --no-auth --ssl # ardo
#    ports:
#      - "9000:9000"
#      - "8000:8000"
#      - "443:9000"
#    environment:
#     - REGISTRY_HTTP_TLS_CERTIFICATE=/certs/portainer.crt # ardo 
#     - REGISTRY_HTTP_TLS_KEY=/certs/portainer.key # ardo
    volumes:
      - portainer_data:/data
      - "/var/run/docker.sock:/var/run/docker.sock:ro"
      #- /root/certs/portainer.key:/certs/portainer.key # ardo
      #- /root/certs/portainer.crt:/certs/portainer.crt # ardo
    networks:
      - agent_network
      - traefik-network
    labels:
      - "traefik.enable=true"
      - "traefik.docker.network=traefik-network"
      - traefik.constraint-label=traefik-network

      ### HTTP-to-HTTPS Middleware attachment (if you want automatic redirection)
      - "traefik.http.routers.portainer.middlewares=http-to-https"
      # portainer.odamus.com
      ### HTTP router
      - "traefik.http.routers.portainer.rule=Host(`portainer.see1.ee`)"
      - "traefik.http.routers.portainer.entrypoints=web"
      ### HTTPS router
      - "traefik.http.routers.portainer-secure.rule=Host(`portainer.see1.ee`)"
      - "traefik.http.routers.portainer-secure.entrypoints=websecure"
      - "traefik.http.routers.portainer-secure.tls.certresolver=mychallenge"

      - "traefik.http.services.portainer.loadbalancer.server.port=9000"

    deploy:
      mode: replicated
      replicas: 1
      placement:
        constraints:
          - node.role == manager
          - node.hostname==hetzner

networks:
  agent_network:
    driver: overlay
    attachable: true
  traefik-network:
    external: true

volumes:
  portainer_data: