docker-compose.prod.yml

version: '3.8'

x-env: &env
  env_file: .env
  environment:
    - TZ=${TZ}

services:
  traefik:
    image: traefik:v2.10
    command: 
      - "--api.insecure=false"
      - "--providers.docker=true"
      - "--providers.docker.exposedbydefault=false"
      - "--entrypoints.web.address=:80"
      - "--entrypoints.websecure.address=:443"
      - "--entrypoints.dashboard.address=:${DASHBOARD_PORT}"
      # Let's Encrypt configuration
      - "--certificatesresolvers.leresolver.acme.httpchallenge=true"
      - "--certificatesresolvers.leresolver.acme.httpchallenge.entrypoint=web"
      - "--certificatesresolvers.leresolver.acme.email=${LETSENCRYPT_EMAIL}"
      - "--certificatesresolvers.leresolver.acme.storage=/letsencrypt/acme.json"
      # Enable dashboard
      - "--api.dashboard=true"
      # Use podman network
      - "--providers.docker.network=podman"
    ports:
      - "${HTTP_PORT}:80"         # HTTP
      - "${HTTPS_PORT}:443"       # HTTPS
      - "${DASHBOARD_PORT}:${DASHBOARD_PORT}"     # Dashboard
    volumes:
      - "/run/user/1000/podman/podman.sock:/var/run/docker.sock:ro"
      - "./letsencrypt:/letsencrypt"
      - "./traefik/traefik.log:/traefik.log"
    environment:
      - DOCKER_HOST=unix:///var/run/docker.sock
      - TZ=${TZ}
    networks:
      - podman
    restart: unless-stopped
    labels:
      - "traefik.enable=true"
      # Dashboard protection
      - "traefik.http.routers.dashboard.rule=Host(`${TRAEFIK_SUBDOMAIN}.${DOMAIN}`)"
      - "traefik.http.routers.dashboard.service=api@internal"
      - "traefik.http.routers.dashboard.entrypoints=websecure"
      - "traefik.http.routers.dashboard.tls.certresolver=leresolver"
      - "traefik.http.routers.dashboard.middlewares=auth"
      # Basic auth for dashboard
      - "traefik.http.middlewares.auth.basicauth.users=${TRAEFIK_BASIC_AUTH}"

  projekt1:
    build: ./projekt1
    networks:
      - podman
    expose:
      - 5000
    environment:
      - FLASK_ENV=production
    restart: unless-stopped
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.projekt1.rule=Host(`${PROJEKT1_SUBDOMAIN}.${DOMAIN}`)"
      - "traefik.http.routers.projekt1.entrypoints=websecure"
      - "traefik.http.routers.projekt1.tls.certresolver=leresolver"
      - "traefik.http.services.projekt1.loadbalancer.server.port=5000"
      # Redirect HTTP to HTTPS
      - "traefik.http.routers.projekt1-http.rule=Host(`${PROJEKT1_SUBDOMAIN}.${DOMAIN}`)"
      - "traefik.http.routers.projekt1-http.entrypoints=web"
      - "traefik.http.routers.projekt1-http.middlewares=redirect-to-https@docker"

  projekt2:
    build: ./projekt2
    networks:
      - podman
    expose:
      - 5000
    environment:
      - FLASK_ENV=production
    restart: unless-stopped
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.projekt2.rule=Host(`${PROJEKT2_SUBDOMAIN}.${DOMAIN}`)"
      - "traefik.http.routers.projekt2.entrypoints=websecure"
      - "traefik.http.routers.projekt2.tls.certresolver=leresolver"
      - "traefik.http.services.projekt2.loadbalancer.server.port=5000"
      # Redirect HTTP to HTTPS
      - "traefik.http.routers.projekt2-http.rule=Host(`${PROJEKT2_SUBDOMAIN}.${DOMAIN}`)"
      - "traefik.http.routers.projekt2-http.entrypoints=web"
      - "traefik.http.routers.projekt2-http.middlewares=redirect-to-https@docker"

  # Global redirect middleware
  traefik-http-redirect:
    image: traefik:v2.10
    command: --providers.directory.watch=true --providers.file.directory=/etc/traefik --providers.file.watch=true
    volumes:
      - ./traefik/redirect.toml:/etc/traefik/redirect.toml
    networks:
      - podman
    labels:
      - "traefik.enable=true"
      - "traefik.http.middlewares.redirect-to-https.redirectscheme.scheme=https"
      - "traefik.http.middlewares.redirect-to-https.redirectscheme.permanent=true"

networks:
  podman:
    name: podman
    external: true