#Traefik docker-compose
version: '3'

services:
        traefik:
                image: traefik:v2.4
                container_name: traefik
                restart: unless-stopped
                security_opt:
                        - no-new-privileges:true
                networks:
                        - t2_proxy
                ports:
                        - 80:80
                        - 443:443
                volumes:
                        - /etc/localtime:/etc/localtime:ro
                        - /var/run/docker.sock:/var/run/docker.sock:ro
                        - ./data/traefik.yml:/traefik.yml:ro
                        - ./data/acme.json:/acme.json
                        - ./data/log:/var/log

                labels:
                        - "traefik.enable=true"
                        - "traefik.http.routers.traefik.entrypoints=web"
                        - "traefik.http.routers.traefik.rule=Host(`domain.host.com`)"
                        - "traefik.http.middlewares.traefik-auth.basicauth.users=user:password"
                        - "traefik.http.middlewares.traefik-https-redirect.redirectscheme.scheme=websecure"
                        - "traefik.http.routers.traefik.middlewares=traefik-https-redirect"
                        - "traefik.http.routers.traefik-secure.entrypoints=websecure"
                        - "traefik.http.routers.traefik-secure.rule=Host(`domain.host.com`)"
                        - "traefik.http.routers.traefik-secure.middlewares=traefik-auth"
                        - "traefik.http.routers.traefik-secure.tls=true"
                        - "traefik.http.routers.traefik-secure.tls.certresolver=http"
                        - "traefik.http.routers.traefik-secure.service=api@internal"

        fail2ban:
                image: crazymax/fail2ban:latest
                container_name: fail2ban
                network_mode: "host"
                cap_add:
                        - NET_ADMIN
                        - NET_RAW
                volumes:
                        #                        - /var/log:/var/log:ro
                        - ./fail2ban/data:/data
                        - ./data/log:/var/log:ro
networks:
        t2_proxy:
                external: true


#Traefik config traefik.yml

api:
        dashboard: true

entryPoints:
        web:
                address: ":80"
        websecure:
                address: ":443"

providers:
        docker:
                endpoint: "unix:///var/run/docker.sock"
                exposedByDefault: false

certificatesResolvers:
        http:
                acme:
                        email: [email protected]
                        storage: acme.json
                        httpChallenge:
                                entrypoint: web

log:
        filePath: "/var/log/traefik.log"
        level: WARN
accessLog:
        filePath: "var/log/access.log"
        filters:
                statusCodes:
                        - "400-499"
                retryAttempts: true


#whoami working in https docker-compose

version: '3'

services:
        whoami:
                image: "traefik/whoami"
                container_name: "whoami"
                labels:
                        - "traefik.enable=true"
                        - "traefik.http.routers.whoami.service=whoami-whoami"
                        - "traefik.http.routers.whoami.rule=Host(`domain.host.com`) && PathPrefix(`/whoami{regex:$$|/.*}`)"
                        - "traefik.http.routers.whoami.entrypoints=websecure"
                        - "traefik.http.routers.whoami.tls=true"
                        - "traefik.http.routers.whoami.tls.certresolver=http"

                          #middlewares
                        - "traefik.http.routers.whoami.middlewares=whoami-stripprefix"
                        - "traefik.http.middlewares.whoami-stripprefix.stripprefix.prefixes=/whoami"
                        - "traefik.http.middlewares.whoami-stripprefix.stripprefix.forceSlash=false"

                          #services
                          #- "traefik.http.services.whoami-whoami.loadbalancer.server.scheme=https"
                        - "traefik.http.services.whoami-whoami.loadbalancer.server.port=80"
                networks:
                        - t2_proxy

networks:
        t2_proxy:
                external: true