Traefik

name: traefik
services:
  traefik:
    build: .
    image: local/traefik
    container_name: traefik
    restart: unless-stopped
    environment:
      TZ: ${TIMEZONE}
      MYDOMAIN: ${MYDOMAIN}
      PRIMARY_NODE_IP: ${PRIMARY_NODE_IP}
      # AWS bootstrap extends the private-network policy by its explicit admin CIDR.
      LOCAL_ACCESS_ADMIN_CIDR: ${LOCAL_ACCESS_ADMIN_CIDR:-127.0.0.1/32}
      # TLS Cert
      CLOUDFLARE_DNS_API_TOKEN: ${CLOUDFLARE_DNS_API_TOKEN}
      TRAEFIK_CERTIFICATESRESOLVERS_LETSENCRYPT_ACME_EMAIL: "${ADMIN_EMAIL}"
      # CrowdSec - Generate key within the crowdsec container: cscli bouncers add traefik-bouncer
      CROWDSEC_ENABLED: ${CROWDSEC_ENABLED:-false}
      CROWDSEC_BOUNCER_API_KEY: ${CROWDSEC_BOUNCER_API_KEY}
    volumes:
      # kics-scan ignore-line
      - /var/run/docker.sock:/var/run/docker.sock:ro # So that Traefik can listen to the Docker events # TODO To improve the security use a docker socket proxy
      - ./config:/etc/traefik/
      - ${DOCKER_VOLUMES}/traefik/logs:/logs
      - ${DOCKER_VOLUMES}/traefik/letsencrypt:/letsencrypt
    ports:
      - 80:80 # HTTP
      - 443:443/tcp # HTTPS
      - 443:443/udp # HTTP/3 - QUIC
    networks:
      proxy:
        # Keep internal widget requests on Docker, preserving hostname/SNI for TLS.
        aliases:
          - traefik.${MYDOMAIN}
      security-authentik: {}
      security-wg-easy: {}
      dev-code-server: {}
      tools-vaultwarden: {}
      backup-kopia: {}
    extra_hosts:
      - host.docker.internal:host-gateway
    labels:
      traefik.enable: true
      traefik.http.routers.api.rule: Host(`traefik.${MYDOMAIN}`) # Define the subdomain for the traefik dashboard
      traefik.http.routers.api.service: api@internal # Enable Traefik API
      traefik.http.routers.api.middlewares: localaccess@file
      homepage.group: Infra
      homepage.name: Traefik
      homepage.icon: traefik.png
      homepage.href: https://traefik.${MYDOMAIN}/
      homepage.description: The Cloud Native Application Proxy
      homepage.widget.type: traefik
      homepage.widget.url: https://traefik.${MYDOMAIN}/

  # Access Logs: https://doc.traefik.io/traefik/observability/access-logs/
  logrotate:
    build:
      dockerfile_inline: |
        FROM alpine:3.21
        RUN apk add --no-cache logrotate
        COPY config/logrotate.conf /etc/logrotate.conf
        RUN chmod 644 /etc/logrotate.conf
        RUN chown root:root /etc/logrotate.conf
        CMD ["sh", "-c", "logrotate -f /etc/logrotate.conf && sleep 86400"]
    container_name: logrotate
    restart: unless-stopped
    volumes:
      - ${DOCKER_VOLUMES}/traefik/logs:/logs

networks:
  proxy:
    external: true
  security-authentik:
    external: true
  security-wg-easy:
    external: true
  dev-code-server:
    external: true
  tools-vaultwarden:
    external: true
  backup-kopia:
    external: true