docker-compose.prod.yml

version: "3.7"
networks:
  web:
    external: true

services:
  traefik:
    image: traefik:v2.3
    restart: always
    networks:
      - web
    ports:
      - "80:80"
      - "443:443"
      # Uncomment for debug
      #- "8080:8080"
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - ./letsencrypt:/letsencrypt
      - ./traefik.auth:/auth/traefik.auth
    command:
      - --api.dashboard=true
      # Uncomment for debug
      #- --api.insecure=true
      - --entrypoints.http.address=:80
      - --entrypoints.https.address=:443
      - --providers.docker=true
      - --providers.docker.exposedbydefault=false
      - --certificatesresolvers.leresolver.acme.httpchallenge.entrypoint=http
      - --certificatesresolvers.leresolver.acme.storage=/letsencrypt/acme.json
      - --certificatesresolvers.leresolver.acme.email=${LETS_ENCRYPT_EMAIL}
    labels:
      ## TRAEFIK ROUTER & DASHBOARD
      - traefik.enable=true
      - traefik.http.routers.traefik.entrypoints=https
      - traefik.http.routers.traefik.rule=Host(`${TRAEFIK_DASHBOARD_HOST}`)
      - traefik.http.routers.traefik.service=api@internal
      - traefik.http.routers.traefik.middlewares=auth
      - traefik.http.routers.traefik.tls.certresolver=leresolver
      - traefik.http.services.traefik.loadbalancer.server.port=8080

      ## Global redirect to HTTPS
      - traefik.http.routers.http-catchall.rule=hostregexp(`{host:.+}`)
      - traefik.http.routers.http-catchall.entrypoints=http
      - traefik.http.routers.http-catchall.middlewares=redirect-to-https

      ## Middlewares
      - traefik.http.middlewares.redirect-to-https.redirectscheme.scheme=https

      ## AUTH
      - traefik.http.middlewares.auth.basicauth.usersfile=/auth/traefik.auth