services:
  traefik:
    container_name: traefik
    image: traefik:v3.6.2

    env_file:
      - .env

    # Static configuration file
    command:
      - --configFile=/etc/traefik/traefik.yml

    ports:
      - "80:80"
      - "443:443"

    environment:
      DOCKER_API_VERSION: "1.52"

    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - ./traefik.yml:/etc/traefik/traefik.yml:ro
      - ./letsencrypt:/letsencrypt
      - ./logs:/var/log/traefik

    restart: unless-stopped
    networks:
      - homelab
    labels:
      traefik.enable: true
      # Dashboard routing
      traefik.http.routers.traefik.rule: Host(`traefik.fig.systems`)
      traefik.http.routers.traefik.entrypoints: websecure
      traefik.http.routers.traefik.tls.certresolver: letsencrypt
      traefik.http.routers.traefik.service: api@internal
      traefik.http.routers.traefik.middlewares: local-only

      # IP Allowlist Middleware for local network only services
      traefik.http.middlewares.local-only.ipallowlist.sourcerange: 10.0.0.0/16

      # CrowdSec Middleware
      traefik.http.middlewares.crowdsec.plugin.crowdsec-bouncer-traefik-plugin.enabled: true
      traefik.http.middlewares.crowdsec.plugin.crowdsec-bouncer-traefik-plugin.crowdsecMode: stream
      traefik.http.middlewares.crowdsec.plugin.crowdsec-bouncer-traefik-plugin.crowdsecLapiKey: ${CROWDSEC_BOUNCER_KEY}
      traefik.http.middlewares.crowdsec.plugin.crowdsec-bouncer-traefik-plugin.crowdsecLapiHost: crowdsec:8080
      traefik.http.middlewares.crowdsec.plugin.crowdsec-bouncer-traefik-plugin.crowdsecLapiScheme: http
      traefik.http.middlewares.crowdsec.plugin.crowdsec-bouncer-traefik-plugin.updateIntervalSeconds: 60
      traefik.http.middlewares.crowdsec.plugin.crowdsec-bouncer-traefik-plugin.defaultDecisionSeconds: 60
      traefik.http.middlewares.crowdsec.plugin.crowdsec-bouncer-traefik-plugin.forwardedHeadersTrustedIPs: 10.0.0.0/16
      traefik.http.middlewares.crowdsec.plugin.crowdsec-bouncer-traefik-plugin.clientTrustedIPs: 10.0.0.0/16

networks:
  homelab:
    external: true