services:
  traefik:
    image: traefik:v3.7
    container_name: traefik
    security_opt:
      - no-new-privileges:true
    networks:
      traefik_lan:
        ipv4_address: 10.0.0.11
      traefik_proxy:
    environment:
      CF_DNS_API_TOKEN: ${CF_DNS_API_TOKEN}
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - /mnt/user/appdata/traefik/letsencrypt:/letsencrypt
    command:
      # Docker provider
      - "--providers.docker=true"
      - "--providers.docker.exposedbydefault=false"
      - "--providers.docker.network=traefik_proxy"

      # HTTP
      - "--entrypoints.web.address=:80"
      - "--entrypoints.web.http.redirections.entrypoint.to=websecure"
      - "--entrypoints.web.http.redirections.entrypoint.scheme=https"
      - "--entrypoints.web.http.redirections.entrypoint.permanent=true"

      # HTTPS
      - "--entrypoints.websecure.address=:443"

      # Other
      - "--entrypoints.gitea-ssh.address=:222"

      # Let's Encrypt / Cloudflare DNS-01
      - "--certificatesresolvers.cloudflare.acme.email=${ACME_EMAIL}"
      - "--certificatesresolvers.cloudflare.acme.storage=/letsencrypt/acme.json"
      - "--certificatesresolvers.cloudflare.acme.dnschallenge=true"
      - "--certificatesresolvers.cloudflare.acme.dnschallenge.provider=cloudflare"

      # Logging
      - "--log.level=INFO"
      - "--accesslog=true"
    labels:
      net.unraid.docker.icon: "https://cdn.jsdelivr.net/gh/selfhst/icons@main/png/traefik-light.png"
      folder.view3: "Networking"

networks:
  traefik_lan:
    external: true
    name: br0

  traefik_proxy:
    external: true