docker-compose.yml

# https://doc.traefik.io/traefik/providers/docker/
# https://doc.traefik.io/traefik/reference/static-configuration/env/
#
# Label your containers with:
# 
# labels:
#  - "traefik.enable=true"
#  - "traefik.http.routers.my-container.entrypoints=websecure"
#  - "traefik.http.routers.my-container.rule=Host(`example.com`)"
#  - "traefik.http.services.my-container.loadbalancer.server.port=<port>
#
# See https://doc.traefik.io/traefik/user-guides/docker-compose/basic-example/
#
# and add them to:
#
# networks:
#  default:
#    name: public_network  # use this network to expose your containers
#
services:

  # https://doc.traefik.io/traefik/getting-started/install-traefik/
  traefik:
    # https://hub.docker.com/_/traefik/tags
    image: traefik:v3.3.3
    container_name: traefik
    restart: always
    user: nobody
    mem_limit: 128M
    hostname: traefik.${HOSTNAME:-foo.bar}
    cpus: 0.2

    ports:
      - 127.0.0.1:${DASHBOARD_PORT:-58888}:8080  # bind to local interface only!
      # - 58889:8080  # public bind
      - ${HTTP_PORT:-80}:1080
      - ${HTTPS_PORT:-443}:1443/tcp
      - ${HTTPS_PORT:-443}:1443/udp # for http3 (quic)
      - 51337:51337 # for tcpep entrypoint

    volumes:
      - "./traefik.yml:/etc/traefik/traefik.yml:ro"
      - "./traefik_dynamic_conf.yml:/etc/traefik/traefik_dynamic_conf.yml:ro"
      - "./letsencrypt:/var/log/letsencrypt/"  # certificates storage

    # https://doc.traefik.io/traefik/reference/static-configuration/env/
    environment:
      TRAEFIK_CERTIFICATESRESOLVERS_MYRESOLVER_ACME_EMAIL: ${ACME_EMAIL:-foo@acme.net}
      HOSTNAME: ${HOSTNAME:-traefik}
      # TRAEFIK_LOG_LEVEL: ${LOG_LEVEL:-INFO}

    # expose prom metrics at /traefik/metrics
    labels:
      traefik.enable: true
      traefik.http.services.traefik-metrics.loadbalancer.server.port: 8080

      # https://doc.traefik.io/traefik/routing/routers/#path-pathprefix-and-pathregexp
      traefik.http.routers.traefik-metrics.rule: "Host(`${HOSTNAME:-foo.bar}`) && Path(`/traefik/metrics`)"

      traefik.http.routers.traefik-metrics.middlewares: "traefik-metrics"
      # https://doc.traefik.io/traefik/middlewares/http/replacepath/
      traefik.http.middlewares.traefik-metrics.replacepath.path: "/metrics"

    healthcheck:
      test: 'traefik healthcheck'
      interval: 15s
      timeout: 3s
      retries: 2

  # https://github.com/Tecnativa/docker-socket-proxy
  socket-proxy:
    image: tecnativa/docker-socket-proxy:0.3
    container_name: docker_socket_proxy
    restart: always
    user: root  # needed to mount the docker.sock
    mem_limit: 8M
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
    ports:
      - '127.0.0.1:2375:2375'  # DOCKER_HOST=tcp://localhost:2375 docker ps
    # https://github.com/Tecnativa/docker-socket-proxy#grant-or-revoke-access-to-certain-api-sections
    environment:
      DISABLE_IPV6: true
      CONTAINERS: 1  # only allow GET requests to the containers API section

    healthcheck:
      test: 'wget --spider http://socket-proxy:2375/_ping'
      interval: 15s
      timeout: 1s
      retries: 2

  # https://github.com/traefik/whoami
  whoami:
    image: traefik/whoami:v1.10
    container_name: whoami
    restart: always
    mem_limit: 8M
    hostname: ${HOSTNAME:-foo.bar}
    environment:
      WHOAMI_NAME: "whoami @ ${HOSTNAME:-foo.bar}"
    labels:
      traefik.enable: true
      traefik.http.services.whoami.loadbalancer.server.port: 80

      # https://doc.traefik.io/traefik/routing/routers/#path-pathprefix-and-pathregexp
      traefik.http.routers.whoami.rule: "Host(`${HOSTNAME:-foo.bar}`) && Path(`/whoami`)"

      traefik.http.routers.whoami.middlewares: "whoami"
      # https://doc.traefik.io/traefik/middlewares/http/replacepath/
      traefik.http.middlewares.whoami.replacepath.path: "/"

# https://docs.docker.com/compose/networking/#configure-the-default-network
networks:
  default:
    name: public-network
    external: true