---
services:
  portainer:
    image: ${PORTAINER_REPO}:${PORTAINER_VERSION}
    restart: unless-stopped
    command: -H unix:///var/run/docker.sock
    labels:
      ### Section Træfik
      - traefik.enable=${TRAEFIK_ENABLED}
      - traefik.docker.network=${TRAEFIK_NETWORK}
      ## HTTP
      - traefik.http.routers.http-${TRAEFIK_ROUTER}.entrypoints=http
      # redirect to HTTPS only
      - traefik.http.routers.http-${TRAEFIK_ROUTER}.middlewares=${TRAEFIK_HTTP_MIDDLEWARES}
      - traefik.http.routers.http-${TRAEFIK_ROUTER}.rule=${TRAEFIK_MATCHRULE}
      ## HTTPS UI
      - traefik.http.routers.https-${TRAEFIK_ROUTER}.entrypoints=https
      # configure the exposed service
      - traefik.http.routers.https-${TRAEFIK_ROUTER}.middlewares=${TRAEFIK_HTTPS_MIDDLEWARES}
      - traefik.http.routers.https-${TRAEFIK_ROUTER}.rule=${TRAEFIK_MATCHRULE}
      # enable TLS and its certificate provider
      - traefik.http.routers.https-${TRAEFIK_ROUTER}.tls=${TRAEFIK_TLSENABLED}
      - traefik.http.routers.https-${TRAEFIK_ROUTER}.tls.certresolver=${TRAEFIK_CERTRESOLVER}
      # specify a service so a custom port can be used
      - traefik.http.services.${TRAEFIK_SERVICE}.loadbalancer.server.port=${TRAEFIK_SERVICE_PORT}
      - traefik.http.routers.https-${TRAEFIK_ROUTER}.service=${TRAEFIK_SERVICE}
      ## HTTPS Edge
      - traefik.http.routers.https-${TRAEFIK_EDGEROUTER}.entrypoints=https
      # configure the exposed service
      - traefik.http.routers.https-${TRAEFIK_EDGEROUTER}.middlewares=${TRAEFIK_HTTPS_MIDDLEWARES}
      - traefik.http.routers.https-${TRAEFIK_EDGEROUTER}.rule=${TRAEFIK_EDGEMATCHRULE}
      # enable TLS and its certificate provider
      - traefik.http.routers.https-${TRAEFIK_EDGEROUTER}.tls=${TRAEFIK_TLSENABLED}
      - traefik.http.routers.https-${TRAEFIK_EDGEROUTER}.tls.certresolver=${TRAEFIK_CERTRESOLVER}
      # specify a service so a custom port can be used
      - traefik.http.services.${TRAEFIK_EDGESERVICE}.loadbalancer.server.port=${TRAEFIK_EDGESERVICE_PORT}
      - traefik.http.routers.https-${TRAEFIK_EDGEROUTER}.service=${TRAEFIK_EDGESERVICE}
      ### Section Diun
      - diun.enable=${DIUN_ENABLE}
      - diun.watch_repo=${DIUN_WATCHREPO}
      - diun.sort_tags=${DIUN_SORTALGO}
      - diun.include_tags=${DIUN_INCLUDE}
      - diun.exclude_tags=${DIUN_EXCLUDE}
    networks:
      - traefik
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
      - ${PORTAINER_DATA}:/data

networks:
  traefik:
    external: true
    name: ${TRAEFIK_NETWORK}