services:
  traefik:
    image: traefik:v3.7.11
    container_name: traefik
    restart: unless-stopped
    command:
      - --providers.docker=true
      - --providers.docker.exposedByDefault=false
      - --providers.docker.network=edge
      - --entrypoints.web.address=:80
      - --entrypoints.web.http.redirections.entrypoint.to=websecure
      - --entrypoints.web.http.redirections.entrypoint.scheme=https
      - --entrypoints.websecure.address=:443
      - --entrypoints.traefik.address=:8080
      - --api.dashboard=true
      - --certificatesresolvers.ovh.acme.dnschallenge=true
      - --certificatesresolvers.ovh.acme.dnschallenge.provider=ovh
      - --certificatesresolvers.ovh.acme.email=k.kruszka@hotmail.com
      - --certificatesresolvers.ovh.acme.storage=/letsencrypt/acme.json
      - --log.level=INFO
    environment:
      - OVH_ENDPOINT=ovh-ca
      - OVH_APPLICATION_KEY=${OVH_APPLICATION_KEY}
      - OVH_APPLICATION_SECRET=${OVH_APPLICATION_SECRET}
      - OVH_CONSUMER_KEY=${OVH_CONSUMER_KEY}
    ports:
      - "80:80"
      - "443:443"
      - "127.0.0.1:8080:8080"   # dashboard, wyłącznie przez tunel SSH
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - ./letsencrypt:/letsencrypt
    networks:
      - edge
    labels:
      - traefik.enable=true
      - traefik.http.routers.dashboard.rule=Host(`traefik.dfkk.cloud`)
      - traefik.http.routers.dashboard.entrypoints=traefik
      - traefik.http.routers.dashboard.service=api@internal

networks:
  edge:
    external: true