################################################################
# https://doc.traefik.io/traefik/getting-started/quick-start/
# https://github.com/chudaozhe/traefik-samples/blob/main/docker-compose.yml
################################################################

version: "3"

services:
  traefik-reverse-proxy:
    # The official v3 Traefik docker image
    image: traefik:v3.1
    command:
      # docker run traefik:v3.1 --help
      # Enables the web UI and tells Traefik to listen to docker
      - --providers.docker.exposedbydefault=false
      - --log.level=DEBUG

      - --api.insecure=true
      - --providers.docker

      - --entryPoints.web.address=:80
      - --entryPoints.websecure.address=:443

      # https://doc.traefik.io/traefik/https/acme/
      - --certificatesresolvers.myresolver.acme.email=i@oo1.dev
      - --certificatesresolvers.myresolver.acme.storage=acme.json

      # used during the challenge
      - --certificatesresolvers.myresolver.acme.httpchallenge.entrypoint=web

    # Declaring the user list
    #
    # Note: when used in docker-compose.yml all dollar signs in the hash need to be doubled for escaping.
    # To create user:password pair, it's possible to use this command:
    # 
    #
    # Also note that dollar signs should NOT be doubled when they not evaluated (e.g. Ansible docker_container module).
    labels:
      # https://doc.traefik.io/traefik/middlewares/http/basicauth/
      # https://community.traefik.io/t/impossible-to-get-basic-auth-for-dashboard/5075/3
      # lumxmTdz4g9s2e37
      - "traefik.enable=true"
      - "traefik.http.routers.dashboard.rule=Host(`dashboard.traefik-example.oo1.dev`)"
      - "traefik.http.routers.dashboard.tls=true"
      - "traefik.http.routers.dashboard.tls.certresolver=myresolver"

      - "traefik.http.routers.dashboard.service=api@internal"
      - "traefik.http.routers.dashboard.middlewares=test-auth" # echo $(htpasswd -nB user) | sed -e s/\\$/\\$\\$/g
      - "traefik.http.middlewares.test-auth.basicauth.users=user:$$2y$$05$$n8dGD49ATPyEYlfkpD6xpevszqPUrjhB3cdrmuGOVxziLsEN01IJa"
    ports:
      # The HTTP port
      - "80:80"
      - "443:443"
      # The Web UI (enabled by --api.insecure=true)
      - "8080:8080"
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
      - ./acme.json:/acme.json # chmod 600 ./acme.json
    # environment: # https://doc.traefik.io/traefik/reference/static-configuration/env/