traefik/docker-compose.yml at main · simovilab/traefik · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
services:
  traefik:
    # Pin a specific patch version in production; bump deliberately.
    image: traefik:v3.6.2
    container_name: traefik
    restart: unless-stopped
    security_opt:
      - no-new-privileges:true
    networks:
      - traefik_proxy
    # Allows routing to services on the host (systemd, etc.) via
    # http://host.docker.internal:<port> from the file provider.
    extra_hosts:
      - "host.docker.internal:host-gateway"
    ports:
      - "80:80"    # HTTP (ACME HTTP-01 challenge + redirect to HTTPS)
      - "443:443"  # HTTPS
    environment:
      # ACME account email (overrides static config via TRAEFIK_* env var).
      - TRAEFIK_CERTIFICATESRESOLVERS_LETSENCRYPT_ACME_EMAIL=${ACME_EMAIL}
      # DNS provider credentials (only uncomment when using DNS challenge).
      # - CF_API_EMAIL=${CF_API_EMAIL}
      # - CF_DNS_API_TOKEN=${CF_DNS_API_TOKEN}
    volumes:
      - /etc/localtime:/etc/localtime:ro
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - ./traefik.yml:/traefik.yml:ro
      - ./acme.json:/acme.json
      - ./config:/config:ro
      - ./logs:/logs
    healthcheck:
      test: ["CMD", "traefik", "healthcheck", "--ping"]
      interval: 30s
      timeout: 5s
      retries: 3
      start_period: 10s
    labels:
      - "traefik.enable=true"

      # Dashboard router (served on HTTPS via api@internal).
      - "traefik.http.routers.traefik-dashboard.rule=Host(`${TRAEFIK_DASHBOARD_DOMAIN}`)"
      - "traefik.http.routers.traefik-dashboard.entrypoints=websecure"
      - "traefik.http.routers.traefik-dashboard.tls=true"
      - "traefik.http.routers.traefik-dashboard.tls.certresolver=${CERT_RESOLVER}"
      - "traefik.http.routers.traefik-dashboard.service=api@internal"
      - "traefik.http.routers.traefik-dashboard.middlewares=dashboard-auth,security-headers@file"

      # Dashboard authentication (basic auth).
      # Consider also chaining ip-allowlist@file for defence in depth.
      - "traefik.http.middlewares.dashboard-auth.basicauth.users=${TRAEFIK_DASHBOARD_AUTH}"

      # NOTE: HTTP->HTTPS redirect is configured globally on the `web`
      # entrypoint in traefik.yml, so no catch-all router is needed here.

networks:
  traefik_proxy:
    external: true