---
version: "3.7"

services:
  traefik:
    image: "{{ $.TRAEFIK_IMAGE }}"
    command:
      - --entrypoints.http.address=:80
      {{ if $.TRAEFIK_LETSENCRYPT_EMAIL }}
      - --entrypoints.http.http.redirections.entrypoint.to=https
      - --entrypoints.http.http.redirections.entrypoint.scheme=https
      - --entrypoints.https.address=:443
      {{ end }}
      - --providers.docker
      - --api={{ $.TRAEFIK_API_ENABLED }}
      - --api.dashboard={{ $.TRAEFIK_DASHBOARD_ENABLED }}

      - --log.level={{ $.TRAEFIK_LOG_LEVEL }}
      - --log.format=json

      {{ if $.TRAEFIK_LETSENCRYPT_EMAIL }}
      - --certificatesresolvers.leresolver.acme.caserver={{ $.TRAEFIK_LETSENCRYPT_SERVER }}
      - --certificatesresolvers.leresolver.acme.email={{ $.TRAEFIK_LETSENCRYPT_EMAIL }}
      - --certificatesresolvers.leresolver.acme.storage=/data/acme.json
      - --certificatesresolvers.leresolver.acme.tlschallenge=true
      {{ end }}

    {{ if or (eq $.TRAEFIK_API_ENABLED "true") ($.TRAEFIK_BASIC_AUTH) ($.TRAEFIK_LETSENCRYPT_EMAIL) }}
    labels:
    {{ else }}
    labels: []
    {{ end }}

      {{ if eq $.TRAEFIK_API_ENABLED "true" }}
      # Dashboard
      - "traefik.http.routers.api.rule=Host(`{{ $.TRAEFIK_API_VHOST }}`)"
      - "traefik.http.routers.api.service=api@internal"
      - "traefik.http.routers.api.entrypoints={{ if $.TRAEFIK_LETSENCRYPT_EMAIL }}https{{ else }}http{{ end }}"
      {{ end }}
      
      {{ if $.TRAEFIK_BASIC_AUTH }}
      - "traefik.http.routers.api.middlewares=auth"
      - "traefik.http.middlewares.auth.basicauth.users={{ $.TRAEFIK_BASIC_AUTH }}"
      {{ end }}

      {{ if $.TRAEFIK_LETSENCRYPT_EMAIL }}
      - "traefik.http.routers.api.tls.certresolver=leresolver"
      {{ end }}

    network_mode: bridge

    ports:
      - "80:80"
      {{ if $.TRAEFIK_LETSENCRYPT_EMAIL }}
      - "443:443"
      {{ end }}

    restart: unless-stopped

    volumes:
      - "/var/run/docker.sock:/var/run/docker.sock:ro"
      - "{{ $.TRAEFIK_DATA_DIR }}:/data"
