docker-compose.secure.yml

version: "3.7"
    
services:
  # plex
  plex:
    labels:
      traefik.enable: "true"
      traefik.docker.network: mediaserver_default
      traefik.http.routers.plex.tls.certresolver: prod
      traefik.http.routers.plex.rule: Host(`${PLEX_HOST}`)
      traefik.http.services.plex.loadbalancer.server.port: 32400
      traefik.http.services.plex.loadbalancer.server.scheme: http

  # jellyfin:
  #   labels:
  #     traefik.enable: "true"
  #     traefik.docker.network: mediaserver_default
  #     traefik.http.routers.jellyfin.tls.certresolver: prod
  #     traefik.http.routers.jellyfin.rule: Host(`${JELLYFIN_HOST}`)
  #     traefik.http.services.jellyfin.loadbalancer.server.port: 8096
  #     traefik.http.services.jellyfin.loadbalancer.server.scheme: http

  # nzbhydra:
  #   labels:
  #     traefik.enable: "true"
  #     traefik.docker.network: mediaserver_default
  #     traefik.http.routers.nzbhydra.tls.certresolver: prod
  #     traefik.http.routers.nzbhydra.rule: Host(`${NZBHYDRA_HOST}`)
  #     traefik.http.routers.nzbhydra.middlewares: hsts-header

  # ombi:
  #   labels:
  #     traefik.enable: "true"
  #     traefik.docker.network: mediaserver_default
  #     traefik.http.routers.ombi.tls.certresolver: prod
  #     traefik.http.routers.ombi.rule: Host(`${OMBI_HOST}`)
  #     traefik.http.routers.ombi.middlewares: hsts-header

  # prowlarr:
  #   labels:
  #     traefik.enable: "true"
  #     traefik.docker.network: mediaserver_default
  #     traefik.http.routers.prowlarr.tls.certresolver: prod
  #     traefik.http.routers.prowlarr.rule: Host(`${PROWLARR_HOST}`)
  #     traefik.http.routers.prowlarr.middlewares: hsts-header, ipallowlist

  # nzbget:
  #   labels:
  #     traefik.enable: "true"
  #     traefik.docker.network: mediaserver_default
  #     traefik.http.routers.nzbget.tls.certresolver: staging
  #     traefik.http.routers.nzbget.rule: Host(`${NZBGET_HOST}`)
  #     traefik.http.routers.nzbget.middlewares: hsts-header, ipallowlist

  # sonarr:
  #   labels:
  #     traefik.enable: "true"
  #     traefik.docker.network: mediaserver_default
  #     traefik.http.routers.sonarr.tls.certresolver: prod
  #     traefik.http.routers.sonarr.rule: Host(`${SONARR_HOST}`)
  #     traefik.http.routers.sonarr.middlewares: hsts-header, ipallowlist

  # radarr
  # radarr:
  #   labels:
  #     traefik.enable: "true"
  #     traefik.docker.network: mediaserver_default
  #     traefik.http.routers.radarr.tls.certresolver: staging
  #     traefik.http.routers.radarr.rule: Host(`${RADARR_HOST}`)
  #     traefik.http.routers.radarr.middlewares: hsts-header, ipallowlist

  # portainer
  # portainer:
  #   labels:
  #     # Frontend
  #     traefik.enable: true
  #     traefik.docker.network: mediaserver_default
  #     traefik.http.routers.portainer.rule: Host(`${PORTAINER_HOST}`)
  #     traefik.http.routers.portainer.entrypoints: websecure
  #     traefik.http.routers.portainer.service: portainer
  #     traefik.http.routers.portainer.tls.certresolver: staging
  #     traefik.http.services.portainer.loadbalancer.server.port: 9000
  #     traefik.http.routers.radarr.middlewares: hsts-header, ipallowlist

  # duplicati:
  #   labels:
  #     traefik.enable: "true"
  #     traefik.docker.network: mediaserver_default
  #     traefik.http.routers.duplicati.tls.certresolver: prod
  #     traefik.http.routers.duplicati.rule: Host(`${DUPLICATI_HOST}`)
  #     traefik.http.routers.duplicati.middlewares: hsts-header, basicauth, ipallowlist

  # netdata:
  #   labels:
  #     traefik.enable: "true"
  #     traefik.docker.network: mediaserver_default
  #     traefik.http.routers.netdata.tls.certresolver: prod
  #     traefik.http.routers.netdata.rule: Host(`${NETDATA_HOST}`)
  #     traefik.http.routers.netdata.middlewares: hsts-header, basicauth, ipallowlist

  # https://hub.docker.com/_/traefik/
  traefik:
    image: traefik:v2.8.5
    restart: unless-stopped
    environment:
      - TZ=${TZ}
    networks:
      - default
    ports:
      - 80:80/tcp
      - 443:443/tcp
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - ${CONFIG_DIR}/traefik:/etc/traefik:rw
      - /var/log/docker:/var/log
    command:
      - "--log.level=DEBUG"
      - "--log.filePath=/var/log/traefik/traefik.log"
      - "--accessLog.filePath=/var/log/traefik/access.log"
#      - "--accessLog.filters.statusCodes=400-499"
      - "--api=true"
      - "--providers.docker=true"
      - "--providers.docker.exposedbydefault=false"
      - "--entrypoints.web.address=:80"
      - "--entrypoints.web.http.redirections.entrypoint.to=websecure"
      - "--entrypoints.web.http.redirections.entrypoint.scheme=https"
      - "--entrypoints.websecure.address=:443"
      - "--certificatesResolvers.prod.acme.tlschallenge=true"
      - "--certificatesresolvers.prod.acme.storage=/etc/traefik/acme.json"
      - "--certificatesresolvers.prod.acme.email=${ACME_EMAIL}"
      - "--certificatesresolvers.prod.acme.caserver=https://acme-v02.api.letsencrypt.org/directory"
      - "--certificatesResolvers.staging.acme.tlschallenge=true"
      - "--certificatesresolvers.staging.acme.storage=/etc/traefik/acme.json"
      - "--certificatesresolvers.staging.acme.email=${ACME_EMAIL}"
      - "--certificatesresolvers.staging.acme.caserver=https://acme-staging-v02.api.letsencrypt.org/directory"
    labels:
      traefik.enable: "true"
      traefik.docker.network: mediaserver_default
      traefik.http.routers.traefik.tls.certresolver: prod
      traefik.http.routers.traefik.rule: Host(`${TRAEFIK_HOST}`)
      traefik.http.routers.traefik.middlewares: hsts-header, basicauth
      traefik.http.routers.traefik.service: api@internal
      traefik.http.middlewares.test-auth.basicauth.users: "${BASICAUTH_USERS}"
      traefik.http.middlewares.basicauth.basicauth.usersfile: /etc/traefik/.htpasswd
      traefik.http.middlewares.ipallowlist.ipwhitelist.sourcerange: "${IPALLOWLIST}"
      traefik.http.middlewares.hsts-header.headers.customResponseHeaders.Strict-Transport-Security: "max-age=63072000"