docker-compose.traefik.yml

services:
  traefik:
    image: traefik:3.0
    ports:
      # Listen on port 80, default for HTTP, necessary to redirect to HTTPS
      - 80:80
      # Listen on port 443, default for HTTPS
      - 443:443
    env_file:
      - .traefik_env
    environment:
      - AWS_ACCESS_KEY_ID=${AWS_ACCESS_KEY_ID}
      - AWS_SECRET_ACCESS_KEY=${AWS_SECRET_ACCESS_KEY}
      - AWS_REGION=${AWS_REGION}
    restart: always
    labels:
      - traefik.enable=true
      - traefik.docker.network=traefik-public
      - traefik.http.services.traefik-dashboard.loadbalancer.server.port=8080

      # HTTP to HTTPS redirection middleware
      - traefik.http.middlewares.https-redirect.redirectscheme.scheme=https
      - traefik.http.middlewares.https-redirect.redirectscheme.permanent=true

      - traefik.http.middlewares.rate-limit-10.ratelimit.average=10

      # HTTP Router (with middleware to redirect to HTTPS)
      - traefik.http.routers.traefik-dashboard-http.entrypoints=http
      - traefik.http.routers.traefik-dashboard-http.rule=Host(`traefik.${DOMAIN?Variable not set}`)
      - traefik.http.routers.traefik-dashboard-http.middlewares=https-redirect

       # Authentication to access traefik dashboard middleware
      - traefik.http.middlewares.admin-auth.basicauth.users=${USERNAME?Variable not set}:${HASHED_PASSWORD?Variable not set}

      # HTTPS Router
      - traefik.http.routers.traefik-dashboard-https.entrypoints=https
      - traefik.http.routers.traefik-dashboard-https.rule=Host(`traefik.${DOMAIN?Variable not set}`)
      - traefik.http.routers.traefik-dashboard-https.tls=true
      - traefik.http.routers.traefik-dashboard-https.tls.certresolver=myresolver
      - traefik.http.routers.traefik-dashboard-https.middlewares=admin-auth,rate-limit-10
      # Use the special Traefik service api@internal with the web UI/Dashboard
      - traefik.http.routers.traefik-dashboard-https.service=api@internal

    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - traefik-public-certificates:/certificates

    command:
      # Enable docker and not to expose it public
      - --providers.docker
      - --providers.docker.exposedbydefault=false
      
      # Entrypoints
      - --entrypoints.http.address=:80
      - --entrypoints.https.address=:443

      # Enable myresolver DNS challange, let's encrypt cert
      - --certificatesresolvers.myresolver.acme.dnschallenge=true  
      - --certificatesresolvers.myresolver.acme.dnschallenge.provider=route53
      - --certificatesresolvers.myresolver.acme.email=${EMAIL?Variable not set}
      - --certificatesresolvers.myresolver.acme.storage=/certificates/acme.json

      # Enable the access log, with HTTP requests, Traefik log and Dashboard API
      - --accesslog
      - --log
      - --api

    networks:
      # Use the public network created to be shared between Traefik and
      # any other service that needs to be publicly available with HTTPS
      - traefik-public

volumes:
  # Create a volume to store the certificates, even if the container is recreated
  traefik-public-certificates:

networks:
  # Use the previously created public network "traefik-public", shared with other
  # services that need to be publicly available via this Traefik
  traefik-public:
    external: true