version: "{{ compose_version }}"

networks:
  proxy:
    name: "{{ traefik_network }}"

services:
  traefik:
    image: traefik:{{ traefik_version }}
    container_name: traefik
    ports:
      - "{{ traefik_http_port }}:80"
      - "{{ traefik_https_port}}:443"
    volumes:
      - /etc/timezone:/etc/timezone:ro
      - /etc/localtime:/etc/localtime:ro
      - /var/run/docker.sock:/var/run/docker.sock
      - ./traefik.toml:/traefik.toml
      - ./traefik_dynamic.toml:/traefik_dynamic.toml
      - {{ traefik_certs_directory }}:/certs
    labels:
      traefik.http.routers.traefik-metrics.entrypoints: websecure
      traefik.http.routers.traefik-metrics.rule: "Host(`{{ traefik_subdomain }}.{{ domain_name }}`) && PathPrefix(`/metrics`)"
      traefik.http.routers.traefik-metrics.service: traefik-metrics
      traefik.http.routers.traefik-metrics.middlewares: traefik-metrics-auth@docker
      # htpasswd string contains $, interpreted as variable,
      # escape them with double $
      traefik.http.middlewares.traefik-metrics-auth.basicauth.users: "metrics:{{ traefik_metrics_htpasswd | replace("$", "$$") }}"
      traefik.http.services.traefik-metrics.loadbalancer.server.port: "{{ traefik_metrics_port }}"
      traefik.http.routers.traefik-api.rule: "Host(`{{ traefik_subdomain }}.{{ domain_name }}`)"
      traefik.http.routers.traefik-api.service: api@internal
      traefik.http.routers.traefik-api.middlewares: traefik-api-auth@docker
      traefik.http.middlewares.traefik-api-auth.basicauth.users: "dashboard:{{ traefik_dashboard_htpasswd | replace("$", "$$") }}"
      traefik.enable: true
    environment:
      GANDIV5_API_KEY: "{{ gandi_api_key }}"
    networks:
      - proxy
    restart: unless-stopped