docker-compose.dev.yml

version: "3.7"
networks:
  proxy:
    external: true

services:
  traefik:
    image: traefik:v2.10
    container_name: "traefik"
    restart: always
    networks:
      - proxy
    ports:
      - "80:80"
      - "443:443"
      # Uncomment for debug
      # - "8080:8080"
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - ./letsencrypt:/letsencrypt
      - ./traefik.auth:/auth/traefik.auth
    command:
     # # Uncomment for debug
     # - --api.insecure=true
      - --entrypoints.web.address=:80
     #- "--log.level=DEBUG"
      - --api.insecure=true
      - --providers.docker=true
      - --providers.docker.exposedbydefault=false
      - --entrypoints.websecure.address=:443
      - --certificatesresolvers.leresolver.acme.tlschallenge=true
      #- --certificatesresolvers.leresolver.acme.caserver=https://acme-staging-v02.api.letsencrypt.org/directory
      - --certificatesresolvers.leresolver.acme.email=${LETS_ENCRYPT_EMAIL}
      - --certificatesresolvers.leresolver.acme.storage=/letsencrypt/acme.json

    labels:
      ## TRAEFIK ROUTER & DASHBOARD
      - traefik.enable=true
      - traefik.http.routers.traefik.entrypoints=websecure
      - traefik.http.routers.traefik.rule=Host(`${TRAEFIK_DASHBOARD_HOST}`)
      ## TLS - https://docs.traefik.io/https/tls/
      ## Specifically, we don't allow connections via the IP address, only via the domain name
      ## https://doc.traefik.io/traefik/https/tls/#strict-sni-checking
      ## - traefik.http.routers.myrouter.tls.options.default.sniStrict=true
      - traefik.http.routers.traefik.service=api@internal
      - traefik.http.routers.traefik.middlewares=auth
      - traefik.http.routers.traefik.tls.certresolver=leresolver
      - traefik.http.services.traefik.loadbalancer.server.port=8080
      # https://github.com/traefik/traefik/issues/1254#issuecomment-299114960
      # https://gist.github.com/thomas15v/a446ac1745829f5a6a5f19c574739af8
      # Traefik was sometimes working, but only sometimes. Telling it specifically
      # which network to choose to run on was what seemed to fix it.
      - traefik.docker.network=proxy

      ## Middleware for http to https redirect
      - traefik.http.middlewares.redirect-to-https.redirectscheme.scheme=websecure

      ## AUTH
      - traefik.http.middlewares.auth.basicauth.usersfile=/auth/traefik.auth

      ## Catch-all redirect to domain
      - traefik.http.routers.catchall.rule=hostregexp(`{any:.+}`)
      - traefik.http.routers.catchall.entrypoints=web
      - traefik.http.routers.catchall.middlewares=redirect

      ## Middleware
      - traefik.http.middlewares.redirect.redirectregex.regex=.*
      - traefik.http.middlewares.redirect.redirectregex.replacement=https://example.com

      ## Global redirect to HTTPS
      #- traefik.http.routers.http-catchall.rule=hostregexp(`{host:.+}`)
      #- traefik.http.routers.http-catchall.rule=Host(`${TRAEFIK_DASHBOARD_HOST}`)
      #- traefik.http.routers.http-catchall.entrypoints=web
      #- traefik.http.routers.http-catchall.middlewares=redirect-to-https