version: '3.8'

services:
  traefik:
    image: traefik:v2.10
    ports:
      - target: 80
        published: 80
        mode: host
      - target: 443
        published: 443
        mode: host
    networks:
      - traefik-public
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - traefik-certificates:/letsencrypt
    environment:
      - TRAEFIK_API=true
      - TRAEFIK_API_DASHBOARD=true
      - TRAEFIK_API_DEBUG=false
      - TRAEFIK_LOG_LEVEL=INFO
      - TRAEFIK_PROVIDERS_DOCKER=true
      - TRAEFIK_PROVIDERS_DOCKER_SWARMMODE=true
      - TRAEFIK_PROVIDERS_DOCKER_EXPOSEDBYDEFAULT=false
      - TRAEFIK_PROVIDERS_DOCKER_NETWORK=traefik-public
      - TRAEFIK_ENTRYPOINTS_HTTP_ADDRESS=:80
      - TRAEFIK_ENTRYPOINTS_HTTPS_ADDRESS=:443
      # Redirect HTTP to HTTPS
      - TRAEFIK_ENTRYPOINTS_HTTP_HTTP_REDIRECTIONS_ENTRYPOINT_TO=https
      - TRAEFIK_ENTRYPOINTS_HTTP_HTTP_REDIRECTIONS_ENTRYPOINT_SCHEME=https
      # Let's Encrypt
      - TRAEFIK_CERTIFICATESRESOLVERS_LETSENCRYPT_ACME_EMAIL=${ACME_EMAIL}
      - TRAEFIK_CERTIFICATESRESOLVERS_LETSENCRYPT_ACME_STORAGE=/letsencrypt/acme.json
      - TRAEFIK_CERTIFICATESRESOLVERS_LETSENCRYPT_ACME_HTTPCHALLENGE=true
      - TRAEFIK_CERTIFICATESRESOLVERS_LETSENCRYPT_ACME_HTTPCHALLENGE_ENTRYPOINT=http
      # Enable metrics
      - TRAEFIK_METRICS_PROMETHEUS=true
      - TRAEFIK_METRICS_PROMETHEUS_ENTRYPOINT=metrics
      - TRAEFIK_ENTRYPOINTS_METRICS_ADDRESS=:8082
    deploy:
      mode: global
      placement:
        constraints:
          - node.role == manager
      update_config:
        parallelism: 1
        delay: 10s
      restart_policy:
        condition: on-failure
      labels:
        - "traefik.enable=true"
        - "traefik.docker.network=traefik-public"
        - "traefik.constraint-label=traefik-public"
        # Dashboard
        - "traefik.http.routers.traefik-dashboard.rule=Host(`${TRAEFIK_HOST}`) && (PathPrefix(`/api`) || PathPrefix(`/dashboard`))"
        - "traefik.http.routers.traefik-dashboard.entrypoints=https"
        - "traefik.http.routers.traefik-dashboard.tls=true"
        - "traefik.http.routers.traefik-dashboard.tls.certresolver=letsencrypt"
        - "traefik.http.routers.traefik-dashboard.service=api@internal"
        - "traefik.http.routers.traefik-dashboard.middlewares=admin-auth"
        # Basic auth for dashboard
        - "traefik.http.middlewares.admin-auth.basicauth.users=${TRAEFIK_DASHBOARD_AUTH}"
        # Global redirect to https
        - "traefik.http.middlewares.redirect-to-https.redirectscheme.scheme=https"
        # Security headers
        - "traefik.http.middlewares.security-headers.headers.frameDeny=true"
        - "traefik.http.middlewares.security-headers.headers.contentTypeNosniff=true"
        - "traefik.http.middlewares.security-headers.headers.browserXssFilter=true"
        - "traefik.http.middlewares.security-headers.headers.stsSeconds=31536000"
        - "traefik.http.middlewares.security-headers.headers.stsIncludeSubdomains=true"
        - "traefik.http.middlewares.security-headers.headers.stsPreload=true"
        # Rate limiting
        - "traefik.http.middlewares.rate-limit.ratelimit.average=100"
        - "traefik.http.middlewares.rate-limit.ratelimit.burst=50"
        # API service
        - "traefik.http.services.traefik.loadbalancer.server.port=8080"
    healthcheck:
      test: ["CMD", "traefik", "healthcheck"]
      interval: 30s
      timeout: 3s
      retries: 3

  # Traefik Forward Auth for advanced authentication (optional)
  traefik-forward-auth:
    image: thomseddon/traefik-forward-auth:latest
    networks:
      - traefik-public
    environment:
      - DEFAULT_PROVIDER=generic-oauth
      - PROVIDERS_GENERIC_OAUTH_AUTH_URL=${OAUTH_AUTH_URL}
      - PROVIDERS_GENERIC_OAUTH_TOKEN_URL=${OAUTH_TOKEN_URL}
      - PROVIDERS_GENERIC_OAUTH_USER_URL=${OAUTH_USER_URL}
      - PROVIDERS_GENERIC_OAUTH_CLIENT_ID=${OAUTH_CLIENT_ID}
      - PROVIDERS_GENERIC_OAUTH_CLIENT_SECRET=${OAUTH_CLIENT_SECRET}
      - SECRET=${OAUTH_SECRET}
      - COOKIE_DOMAIN=${COOKIE_DOMAIN}
      - INSECURE_COOKIE=false
      - LOG_LEVEL=info
      - URL_PATH=/_oauth
      - WHITELIST=${OAUTH_WHITELIST}
    deploy:
      replicas: 2
      restart_policy:
        condition: on-failure
      labels:
        - "traefik.enable=true"
        - "traefik.docker.network=traefik-public"
        - "traefik.http.routers.traefik-forward-auth.rule=Host(`${FRONTEND_HOST}`) && PathPrefix(`/_oauth`)"
        - "traefik.http.routers.traefik-forward-auth.entrypoints=https"
        - "traefik.http.routers.traefik-forward-auth.tls=true"
        - "traefik.http.routers.traefik-forward-auth.tls.certresolver=letsencrypt"
        - "traefik.http.routers.traefik-forward-auth.middlewares=auth-verify"
        - "traefik.http.services.traefik-forward-auth.loadbalancer.server.port=4181"
        - "traefik.http.middlewares.auth-verify.forwardauth.address=http://traefik-forward-auth:4181"
        - "traefik.http.middlewares.auth-verify.forwardauth.authResponseHeaders=X-Forwarded-User"

networks:
  traefik-public:
    external: true

volumes:
  traefik-certificates:
    driver: local