services:
  traefik:
    image: traefik:${TRAEFIK_VER}
    container_name: traefik
    restart: unless-stopped
    networks: [traefik_proxy]
    ports: ["80:80","443:443"]
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - ./config/traefik.yml:/etc/traefik/traefik.yml:ro
      - ./dynamic:/etc/traefik/dynamic:ro
      - ./data/acme.json:/acme/acme.json
    environment:
      CF_DNS_API_TOKEN: ${CF_DNS_API_TOKEN}
    security_opt: [no-new-privileges:true]
    read_only: true
    tmpfs: ["/tmp:size=64m"]
    cap_drop: [ALL]
    cap_add: [NET_BIND_SERVICE]
    healthcheck:
      test: ["CMD","wget","--no-verbose","--tries=1","--spider","http://localhost:8080/ping"]
      interval: 30s
      timeout: 3s
      retries: 5
networks:
  traefik_proxy:
    external: true