docker-compose.yml

version: '3.7'

services:
  traefik:
    container_name: traefik
    build: ./build/traefik/ 
    restart: unless-stopped
    networks:
      dmz:
        ipv4_address: ${DOCKER_TRAEFIK_IP}
      web:
    volumes:
      #- traefik-conf:/etc/traefik
      - ./config/traefik/toml:/etc/traefik/toml
      - ./config/traefik/traefik.toml:/etc/traefik/traefik.toml
      - traefik-acme:/etc/acme
      - /var/run/docker.sock:/var/run/docker.sock:ro
    environment:
      - PUID=${PUID}
      - PGID=${PGID}
      - TZ=${TZ}
    labels:
      - "traefik.enable=true"
      - "traefik.docker.network=web"

      - "traefik.http.middlewares.traefik-redirect.redirectregex.regex=^https://([^/]+)/(|dashboard)$$"
      - "traefik.http.middlewares.traefik-redirect.redirectregex.replacement=https://$${1}/dashboard/"
      - "traefik.http.middlewares.traefik-redirect.redirectregex.permanent=true"

      - "traefik.http.routers.dashboard.entrypoints=websecure"
      - "traefik.http.routers.dashboard.middlewares=traefik-redirect@docker,chain-oauth@file"
      - "traefik.http.routers.dashboard.rule=Host(`traefik.${DOMAINNAME}`)"
      - "traefik.http.routers.dashboard.tls.certResolver=tls"
      - "traefik.http.routers.dashboard.service=api@internal"
      - "traefik.http.services.dashboard.loadbalancer.server.port=8080"

  portainer:
    container_name: portainer
    image: portainer/portainer:1.24.2-alpine
    command: -H unix:///var/run/docker.sock --admin-password '${PORTAINER_PASSWORD_HASH}'
    restart: unless-stopped
    networks:
      - web
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
      - portainer-data:/data
    environment:
      - PUID=${PUID}
      - PGID=${PGID}
      - TZ=${TZ}
    labels:
      - "traefik.enable=true"
      - "traefik.docker.network=web"

      - "traefik.http.routers.portainer.entrypoints=websecure"
      - "traefik.http.routers.portainer.middlewares=chain-oauth@file"
      - "traefik.http.routers.portainer.rule=Host(`portainer.${DOMAINNAME}`)"
      - "traefik.http.routers.portainer.tls.certResolver=tls"
      - "traefik.http.routers.portainer.service=portainer@docker"
      - "traefik.http.services.portainer.loadbalancer.server.port=9000"

  authelia:
    container_name: authelia
    image: authelia/authelia:4.37.5
    volumes:
      - ./config/authelia:/config
    networks:
      - web
    restart: unless-stopped
    environment:
      - PUID=${PUID}
      - PGID=${PGID}
      - TZ=${TZ}
    labels:
      - "traefik.enable=true"
      - "traefik.docker.network=web"

      - "traefik.http.middlewares.authelia.forwardauth.address=http://authelia.web:9091/api/verify?rd=https://authelia.${DOMAINNAME}"
      - "traefik.http.middlewares.authelia.forwardauth.trustForwardHeader=true"
      - "traefik.http.middlewares.authelia.forwardauth.authResponseHeaders=Remote-User, Remote-Groups"

      - "traefik.http.routers.authelia.rule=Host(`authelia.${DOMAINNAME}`)"
      - "traefik.http.routers.authelia.service=authelia@docker"
      - "traefik.http.routers.authelia.entrypoints=websecure"
      - "traefik.http.routers.authelia.tls.certresolver=tls"
      - "traefik.http.services.authelia.loadbalancer.server.port=9091"


  heimdall:
    container_name: heimdall
    image: lscr.io/linuxserver/heimdall
    restart: unless-stopped
    networks:
      - web
    volumes:
      - ./config/heimdall:/config
    environment:
      - PUID=${PUID}
      - PGID=${PGID}
      - TZ=${TZ}
    labels:
      - "traefik.enable=true"
      - "traefik.docker.network=web"

      - "traefik.http.routers.heimdall.entrypoints=websecure"
      - "traefik.http.routers.heimdall.middlewares=chain-oauth@file"
      - "traefik.http.routers.heimdall.rule=Host(`heimdall.${DOMAINNAME}`)"
      - "traefik.http.routers.heimdall.tls.certResolver=tls"
      - "traefik.http.routers.heimdall.service=heimdall@docker"
      - "traefik.http.services.heimdall.loadbalancer.server.port=80"


networks:
  web:
    external: true
  dmz:
    external: true

volumes:
  traefik-conf:
    name: traefik-conf
  traefik-acme:
    name: traefik-acme
  portainer-data:
    name: portainer-data