services:
  traefik:
    image: traefik:latest
    container_name: traefik
    network_mode: host
    restart: unless-stopped
    environment:
      - CLOUDFLARE_EMAIL=${CLOUDFLARE_EMAIL}
      - CLOUDFLARE_DNS_API_TOKEN=${CLOUDFLARE_DNS_API_TOKEN}
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - ./certs:/letsencrypt
      - ./dashboard_authfile:/dashboard_authfile:ro
      - ./dynamic.yml:/dynamic.yml
      - ./traefik.yml:/traefik.yml:ro
      - ./access.log:/access.log:ro
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.traefik.rule=Host(`gbanyan.net`) && (PathPrefix(`/api`) || PathPrefix(`/dashboard`))"
      - "traefik.http.routers.traefik.entrypoints=websecure"
      - "traefik.http.routers.traefik.tls.certresolver=letsencrypt"
      - "traefik.http.routers.traefik.service=api@internal"
      - "traefik.http.routers.traefik.middlewares=auth"
      - "traefik.http.middlewares.auth.basicauth.usersfile=/dashboard_authfile"
      - "traefik.http.services.traefik.loadbalancer.server.port=443"