version: '3'

services:
  traefik:
    image: traefik:v3.6.7
    container_name: traefik
    restart: unless-stopped
    security_opt:
      - no-new-privileges:true
    networks:
      - exposed
    ports:
      - 80:80
      - 443:443
      - 2022:2022
    environment:
      - HETZNER_API_TOKEN=${HETZNER_API_TOKEN}
      - DUCKDNS_TOKEN=${DUCKDNS_TOKEN}
      - AUTH_STRING=${AUTH_STRING}
      - DUCKDNS_POLLING_INTERVAL=5
      - DUCKDNS_PROPAGATION_TIMEOUT=120
    volumes:
      - /etc/localtime:/etc/localtime:ro
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - ${PROJECT_PATH-$PWD}/traefik.yml:/traefik.yml:ro
      - ${PROJECT_PATH-$PWD}/config:/config:ro
      - traefik-certs:/certs
    labels:
      traefik.enable: true

      traefik.http.routers.traefik-dashboard.entrypoints: https
      traefik.http.routers.traefik-dashboard.rule: Host(`traefik.arpa.urmel.de`)
      traefik.http.routers.traefik-dashboard.tls: "true"
      traefik.http.routers.traefik-dashboard.tls.certresolver: hetzner
      traefik.http.routers.traefik-dashboard.service: api@internal
      traefik.http.routers.traefik-dashboard.middlewares: local-only@file, traefik-auth@file

volumes:
  traefik-certs:

networks:
  exposed:
    ipam:
      driver: default
      config:
        - subnet: 172.18.0.0/16
          ip_range: 172.18.128.0/17
          gateway: 172.18.0.1