---
services:
  traefik:
    image: "{{ $.TRAEFIK_IMAGE }}"
    command:
      - --entrypoints.http.address=:80
      {{ if $.TRAEFIK_LETSENCRYPT_EMAIL }}
      - --entrypoints.http.http.redirections.entrypoint.to=https
      - --entrypoints.http.http.redirections.entrypoint.scheme=https
      - --entrypoints.https.address=:443
      {{ end }}
      {{ if and ($.TRAEFIK_API_ENTRY_POINT) ($.TRAEFIK_API_ENTRY_POINT_ADDRESS) }}
      - --entrypoints.{{ $.TRAEFIK_API_ENTRY_POINT }}.address={{ $.TRAEFIK_API_ENTRY_POINT_ADDRESS }}
      {{ end }}
      - --providers.docker
      - --providers.docker.exposedByDefault=false
      - --api={{ $.TRAEFIK_API_ENABLED }}
      - --api.dashboard={{ $.TRAEFIK_DASHBOARD_ENABLED }}

      - --log.level={{ $.TRAEFIK_LOG_LEVEL }}
      - --log.format=json

      {{ if $.TRAEFIK_LETSENCRYPT_EMAIL }}
      - --certificatesresolvers.leresolver.acme.caserver={{ $.TRAEFIK_LETSENCRYPT_SERVER }}
      - --certificatesresolvers.leresolver.acme.email={{ $.TRAEFIK_LETSENCRYPT_EMAIL }}
      - --certificatesresolvers.leresolver.acme.storage=/data/acme.json
      {{ if and (eq $.TRAEFIK_CHALLENGE_MODE "dns") ($.TRAEFIK_DNS_PROVIDER) }}
      - --certificatesresolvers.leresolver.acme.dnschallenge=true
      - --certificatesresolvers.leresolver.acme.dnschallenge.provider={{ $.TRAEFIK_DNS_PROVIDER }}
      {{ else }}
      - --certificatesresolvers.leresolver.acme.tlschallenge=true
      {{ end }}
      {{ end }}

    {{ if $.TRAEFIK_DNS_PROVIDER_ENV_VARS }}
    environment:
      {{ range $env_var := $.TRAEFIK_DNS_PROVIDER_ENV_VARS | split "\n" }}
      {{ $env_parts := $env_var | split " " }}
      {{ $env_key := index $env_parts 0 }}
      {{ $env_value := index $env_parts 1 }}
      {{ if $env_key }}
      - {{ $env_key | replace "dns-provider-" "" | upper }}={{ $env_value }}
      {{ end }}
      {{ end }}
    {{ end }}

    {{ if or (eq $.TRAEFIK_API_ENABLED "true") ($.TRAEFIK_BASIC_AUTH) ($.TRAEFIK_LETSENCRYPT_EMAIL) }}
    labels:
    {{ else }}
    labels: []
    {{ end }}

      {{ if eq $.TRAEFIK_API_ENABLED "true" }}
      # Dashboard
      - "traefik.enable=true"
      - "traefik.http.routers.api.rule=Host(`{{ $.TRAEFIK_API_VHOST }}`)"
      - "traefik.http.routers.api.service=api@internal"
      - "traefik.http.routers.api.entrypoints={{ if $.TRAEFIK_API_ENTRY_POINT }}{{ $.TRAEFIK_API_ENTRY_POINT }}{{ else if $.TRAEFIK_LETSENCRYPT_EMAIL }}https{{ else }}http{{ end }}"
      {{ end }}

      {{ if $.TRAEFIK_BASIC_AUTH }}
      - "traefik.http.routers.api.middlewares=auth"
      - "traefik.http.middlewares.auth.basicauth.users={{ $.TRAEFIK_BASIC_AUTH }}"
      {{ end }}

      {{ if and ($.TRAEFIK_LETSENCRYPT_EMAIL) (not $.TRAEFIK_API_ENTRY_POINT) }}
      - "traefik.http.routers.api.tls.certresolver=leresolver"
      {{ end }}

    network_mode: bridge

    ports:
      - "80:80"
      {{ if $.TRAEFIK_LETSENCRYPT_EMAIL }}
      - "443:443"
      {{ end }}
      {{ if and ($.TRAEFIK_API_ENTRY_POINT) ($.TRAEFIK_API_ENTRY_POINT_ADDRESS) }}
      - "{{ $.TRAEFIK_API_ENTRY_POINT_ADDRESS }}:{{ $.TRAEFIK_API_ENTRY_POINT_PORT }}"
      {{ end }}

    restart: unless-stopped

    volumes:
      - "/var/run/docker.sock:/var/run/docker.sock:ro"
      - "{{ $.TRAEFIK_DATA_DIR }}:/data"