services:
  traefik:
    image: traefik:{{ traefik.version }}
    container_name: traefik
    restart: unless-stopped
    security_opt:
      - no-new-privileges:true
    networks:
      - exposed
    ports:
      - {{ traefik.http_port }}:{{ traefik.http_port }}
      - {{ traefik.https_port }}:{{ traefik.https_port }}

      {% for port in traefik.expose_additional_ports -%}
      - "{{ port }}:{{ port }}"
      {% endfor %}

    environment:
      - HETZNER_API_TOKEN={{ traefik.hetzner_api_token }}
      {% if traefik.duckdns_api_token -%}
      - DUCKDNS_TOKEN={{ traefik.duckdns_api_token }}
      {% endif -%}

      - AUTH_STRING={{ traefik.basic_auth_password }}
      - DUCKDNS_POLLING_INTERVAL=5
      - DUCKDNS_PROPAGATION_TIMEOUT=120
    volumes:
      - /etc/localtime:/etc/localtime:ro
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - ./config/traefik.yml:/traefik.yml:ro
      - ./config/file_provider:/config:ro
      - ./data/certs:/certs
    labels:
      traefik.enable: true

      traefik.http.routers.traefik-dashboard.entrypoints: https
      traefik.http.routers.traefik-dashboard.rule: Host(`traefik.arpa.{{ arpa_top_level }}`)
      traefik.http.routers.traefik-dashboard.tls: "true"
      traefik.http.routers.traefik-dashboard.tls.certresolver: hetzner
      traefik.http.routers.traefik-dashboard.service: api@internal
      traefik.http.routers.traefik-dashboard.middlewares: local-only@file

networks:
  exposed:
    ipam:
      driver: default
      config:
        - subnet: 172.18.0.0/16
          ip_range: 172.18.128.0/17
          gateway: 172.18.0.1