version: "3" services: traefik: image: traefik:${TRAEFIK_VERSION} container_name: ${TRAEFIK_CONTAINER_NAME} restart: unless-stopped command: # when debugging is needed - --accesslog=${TRAEFIK_ACCESSLOG} # enable Træfik dashboard - --api.dashboard=true # configure Let's Encrypt automatic certificates - --certificatesresolvers.letsencrypt.acme.dnschallenge=true - --certificatesresolvers.letsencrypt.acme.dnschallenge.provider=hetzner - --certificatesresolvers.letsencrypt.acme.email=${LETSENCRYPT_EMAIL} - --certificatesresolvers.letsencrypt.acme.keytype=RSA4096 - --certificatesresolvers.letsencrypt.acme.storage=/le-certs.json # we listen on both HTTP and HTTPS - --entrypoints.http.address=:80 - --entrypoints.https.address=:443 # logging level - --log.level=${TRAEFIK_LOGLEVEL} # Træfik Pilot token (of course retrieved from dotenv) - --pilot.token=${TRAEFIK_PILOT_TOKEN} # we only use Docker (for now) - --providers.docker=true # and we want to manually specify exposed containers - --providers.docker.exposedbydefault=false - --providers.docker.watch=true # should not need, but just in case, a folder for dynamic config files is also configured - --providers.file.directory=/config - --providers.file.watch=true environment: - HETZNER_API_KEY=${HETZNER_API_KEY} labels: # expose Træfik using Træfik (dashboard) - traefik.enable=true # configure a global whitelist for my home - traefik.http.middlewares.dashboard-whitelist.ipwhitelist.sourcerange=${TRAEFIK_DASHBOARD_WHITELIST} # configure the global redirect middleware - traefik.http.middlewares.http-to-https.redirectscheme.scheme=https - traefik.http.middlewares.http-to-https.redirectscheme.permanent=true ### Section HTTP - traefik.http.routers.http-${TRAEFIK_ROUTER}.entrypoints=http # only some people can access the dashboard, hence protect it with it's whitelist - traefik.http.routers.http-${TRAEFIK_ROUTER}.middlewares=dashboard-whitelist # redirect Træfik dashboard to HTTPS only - traefik.http.routers.http-${TRAEFIK_ROUTER}.middlewares=http-to-https - traefik.http.routers.http-${TRAEFIK_ROUTER}.rule=Host(`${TRAEFIK_MATCHRULE}`) - traefik.http.routers.http-${TRAEFIK_ROUTER}.service=api@internal ### Section HTTPS - traefik.http.routers.https-${TRAEFIK_ROUTER}.entrypoints=https # only some people can access the dashboard, hence protect it with it's whitelist - traefik.http.routers.https-${TRAEFIK_ROUTER}.middlewares=dashboard-whitelist # configure Træfik dashboard to be the exposed service - traefik.http.routers.https-${TRAEFIK_ROUTER}.rule=Host(`${TRAEFIK_MATCHRULE}`) - traefik.http.routers.https-${TRAEFIK_ROUTER}.service=api@internal # of course, enable TLS and it's certificate provider - traefik.http.routers.https-${TRAEFIK_ROUTER}.tls=true - traefik.http.routers.https-${TRAEFIK_ROUTER}.tls.certresolver=letsencrypt networks: - traefik ports: - 80:80 - 443:443 volumes: - /var/run/docker.sock:/var/run/docker.sock:ro - ./config:/config:ro - ./le-certs.json:/le-certs.json networks: traefik: external: true name: ${TRAEFIK_NETWORK}