secrets:
  duckdns-token:
    file: ./duckdns-token
  #cf-token:
    #file: ./cf-token

services:
  traefik:
    image: traefik:latest
    container_name: traefik
    logging:
      driver: "json-file"
      options:
        max-size: "10m"
        max-file: "3"
    restart: unless-stopped
    security_opt:
      - no-new-privileges:true
    deploy:
      resources:
        limits:
          cpus: '0.50'
          memory: 256M
        reservations:
          memory: 64M
    depends_on:
      socket-proxy:
        condition: service_healthy
    secrets:
      - duckdns-token
      # - cf-token
    env_file:
      - .env
    networks:
      - proxy
      - monitoring
      - socket_net        # Added private network to talk to the socket proxy
    ports:
      - 80:80
      - 443:443
      - 51820:51820/udp
      - 8082:8082
    environment:
      - TZ=America/Chicago
      - DUCKDNS_TOKEN_FILE=/run/secrets/duckdns-token
      # - CF_DNS_API_TOKEN_FILE=/run/secrets/cf-token
      - TRAEFIK_DASHBOARD_CREDENTIALS=${TRAEFIK_DASHBOARD_CREDENTIALS}
      - GITHUB_TOKEN=${GITHUB_TOKEN}
    volumes:
      - /etc/localtime:/etc/localtime:ro
      # REMOVED: /var/run/docker.sock has been removed from here for security
      - ./traefik/traefik.yml:/traefik.yml:ro
      - ./traefik/acme.json:/acme.json
      - ./traefik/config.yml:/config.yml:ro
      # Log directory mappings matching traefik.yml filepaths
      - ./traefik/logs:/var/log/traefik
      - ./traefik/access_logs:/var/log/access
    healthcheck:
      test: ["CMD", "traefik", "healthcheck", "--entrypoints=traefik"]
      interval: 10s
      timeout: 2s
      retries: 3
      start_period: 5s
    #healthcheck: Had to change after adding aliasHeadersStrategy: delete
      #test: ["CMD", "traefik", "healthcheck", "--ping"]
      #interval: 10s
      #timeout: 2s
      #retries: 3
      #start_period: 5s
    labels:
      - "traefik.enable=true"

      # Secure Dashboard Router Configuration
      - "traefik.http.routers.traefik-secure.rule=Host(`traefik.example.duckdns.org`)"
      - "traefik.http.routers.traefik-secure.entrypoints=websecure"
      - "traefik.http.routers.traefik-secure.middlewares=traefik-auth"
      - "traefik.http.routers.traefik-secure.service=api@internal"
      - "traefik.http.middlewares.traefik-auth.basicauth.users=${TRAEFIK_DASHBOARD_CREDENTIALS}"

      # Wildcard SSL Trigger definitions
      - "traefik.http.routers.traefik-secure.tls=true"
      - "traefik.http.routers.traefik-secure.tls.certresolver=letsencrypt"
      - "traefik.http.routers.traefik-secure.tls.domains[0].main=example.duckdns.org"
      - "traefik.http.routers.traefik-secure.tls.domains[0].sans=*.example.duckdns.org"

  socket-proxy:
    image: lscr.io/linuxserver/socket-proxy:latest
    container_name: socket-proxy
    restart: unless-stopped
    security_opt:
      - no-new-privileges:true
    deploy:
      resources:
        limits:
          cpus: '0.25'
          memory: 64M
        reservations:
          memory: 16M
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
    environment:
      - CONTAINERS=1
      - IMAGES=1
      - EVENTS=1
      - SERVICES=1
      - INFO=1
      - NETWORKS=1        # Allows Traefik to look up proxy network configurations
    networks:
      - socket_net        # Keep it isolated; do NOT attach to 'proxy' or 'monitoring'
    healthcheck:
      test:
        - CMD
        - nc
        - -z
        - 127.0.0.1
        - "2375"
      interval: 5s
      timeout: 3s
      retries: 3
      start_period: 5s

networks:
  monitoring:
  proxy:
    external: true
  socket_net:
    name: traefik_socket_net  # This names it explicitly