version: '3.8'

services:
  traefik:
    image: traefik:v3.0 # Or the latest v3.x image
    command:
      # Global Configuration
      - --global.checknewversion=true
      - --global.sendanonymoususage=false

      # Entrypoints (where Traefik listens for traffic)
      - --entrypoints.web.address=:80
      - --entrypoints.websecure.address=:443

      # Enable Traefik Dashboard (optional, for monitoring and debugging)
      - --api.dashboard=true
      - --api.insecure=true # WARNING: Do not use in production without proper authentication

      # Enable Swarm Provider
      - --providers.swarm=true
      - --providers.swarm.exposedbydefault=false # Only expose services with 'traefik.enable=true' label
      - --providers.swarm.network=traefik-public # Specify the overlay network for service discovery

      # Let's Encrypt Configuration
      - --certificatesresolvers.myresolver.acme.tlschallenge=true # Use TLS-ALPN-01 challenge
      - --certificatesresolvers.myresolver.acme.email=emrekirman10@gmail.com # Replace with your email
      - --certificatesresolvers.myresolver.acme.storage=/etc/traefik/acme/acme.json # Persistent storage for certificates
      # - --certificatesresolvers.myresolver.acme.caserver=https://acme-staging-v02.api.letsencrypt.org/directory # Uncomment for testing to avoid hitting rate limits

      # Access Logs (optional)
      - --accesslog=true
      - --accesslog.filepath=/var/log/traefik/access.log

      # Log Level (optional)
      - --log.level=INFO

    ports:
      - 80:80 # HTTP
      - 443:443 # HTTPS
      - 8080:8080 # Traefik Dashboard (uncomment if using --api.dashboard=true)
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro # Mount Docker socket for Swarm provider
      - /var/data/acme:/etc/traefik/acme # Persistent storage for Let's Encrypt certificates
      - /var/data/logs:/var/log/traefik # Persistent storage for access logs (optional)
    networks:
      - traefik-public
    deploy:
      mode: global # Deploy Traefik on all manager nodes (or a specific one with placement constraints)
      placement:
        constraints:
          - node.role == manager # Run Traefik only on manager nodes (recommended)
      restart_policy:
        condition: on-failure
      labels:
        # Traefik Dashboard exposure (if enabled)
        - traefik.enable=true
        - traefik.http.routers.traefik-dashboard.rule=Host(`traefik.emrekirman.xyz`) # Replace with your dashboard domain
        - traefik.http.routers.traefik-dashboard.entrypoints=websecure
        - traefik.http.routers.traefik-dashboard.service=api@internal
        - traefik.http.routers.traefik-dashboard.tls.certresolver=myresolver
        # Optional: Basic Auth for Dashboard (highly recommended for production)
        # - traefik.http.routers.traefik-dashboard.middlewares=traefik-auth
        # - traefik.http.middlewares.traefik-auth.basicauth.users=user:$$apr1$$HASHED_PASSWORD_HERE
          # You can generate the hashed password with `echo $(htpasswd -nb user password)`
networks:
  traefik-public:
    external: true # Use an existing overlay network