networks:
  web:
    external: true

services:
  traefik:
    image: "traefik:v3.1.7"
    restart: unless-stopped
    networks:
      - web
    ports:
      - "80:80"
      - "443:443"
#      - "8080:8080"
    command:
      # Entrypoints
      - "--entrypoints.web.address=:80"
      - "--entrypoints.web.http.redirections.entrypoint.to=websecure"
      - "--entrypoints.websecure.address=:443"
      - "--entrypoints.websecure.http.tls.certresolver=letsencrypt"
      # Docker provider
      - "--providers.docker"
      - "--providers.docker.exposedbydefault=false"
      - "--providers.docker.network=web"
      # Let's encrypt
      - "--certificatesresolvers.letsencrypt.acme.email=${CERT_EMAIL}"
      - "--certificatesresolvers.letsencrypt.acme.httpchallenge.entrypoint=web"
      - "--certificatesresolvers.letsencrypt.acme.storage=acme.json"
      - "--certificatesresolvers.letsencrypt.acme.httpchallenge=true"
      # File provider
      - "--providers.file.directory=/conf.d/"
      - "--providers.file.watch=true"
      # Dashboard
#      - "--api.dashboard=true"
#      - "--api.insecure=true"
    environment:
      NAS_DOMAIN: ${NAS_DOMAIN}
      NAS_URL: ${NAS_URL}
      HA_DOMAIN: ${HA_DOMAIN}
      HA_URL: ${HA_URL}
    volumes:
      - "./conf.d:/conf.d"
      - "./acme.json:/acme.json"
      - "/var/run/docker.sock:/var/run/docker.sock:ro"
    labels:
      - "traefik.enable=true"
      - "traefik.http.middlewares.https-redirect.redirectscheme.scheme=https"
      - "traefik.http.middlewares.https-redirect.redirectscheme.permanent=true"