traefik + cloudflared compose

version: "3.8"

networks:
  cftunnel-transport:
  cloud-public:
    external: true

services:
  tunnel:
    image: cloudflare/cloudflared
    restart: unless-stopped
    command: tunnel run
    environment:
      - TUNNEL_TOKEN=${CLOUDFLARED_TOKEN}
      - TUNNEL_LOGLEVEL=debug
    networks:
      - cftunnel-transport

  traefik:
    image: traefik:v2.10.4
    restart: unless-stopped
    command:
      # Docker settings
      - --providers.docker
      - --providers.docker.endpoint=unix:///var/run/docker.sock # Use the secure docker socket proxy
      - --providers.docker.exposedbydefault=false # Don't expose containers per default
      - --providers.docker.swarmmode=false # Enable swarmmode
      - --providers.docker.network=cloud-public # Use the cloud-publi docker network
      - --providers.docker.constraints=Label(`traefik.constraint-label`, `cloud-public`) # Add a constraint to only use services with the label "traefik.constraint-label=cloud-public"

      # Entrypoints
      - --entrypoints.web.address=:80 # http
      - --entrypoints.websecure.address=:443 # https

      # Dashboard
      - --api
      - --api.dashboard=false

      # Certificates
      # see certificates.yaml
      # in my case I use an origin server certificate from cloudflare
      - --providers.file.filename=/certificates.yaml

      # Logging
      - --accesslog=true
      - --log.level=debug
    deploy:
      mode: global
      labels:
        # traefik.enable is required because we don't expose all containers automatically
        - traefik.enable=true
        - traefik.docker.network=cloud-public
        - traefik.constraint-label=cloud-public

        # Global redirection: HTTP to HTTPS
        - traefik.http.routers.http-redirects.entrypoints=web
        - traefik.http.routers.http-redirects.rule=hostregexp(`{host:(www\.)?.+}`)
        - traefik.http.routers.http-redirects.middlewares=traefik-ratelimit,redirect-to-non-www-https

        # Global redirection: HTTPS www to HTTPS non-www
        - traefik.http.routers.www-redirects.entrypoints=websecure
        - traefik.http.routers.www-redirects.rule=hostregexp(`{host:(www\.).+}`)
        - traefik.http.routers.www-redirects.tls=true
        - traefik.http.routers.www-redirects.tls.options=default
        - traefik.http.routers.www-redirects.middlewares=traefik-ratelimit,redirect-to-non-www-https

        # Middleware to redirect to bare https
        - traefik.http.middlewares.redirect-to-non-www-https.redirectregex.regex=^https?://(?:www\.)?(.+)
        - traefik.http.middlewares.redirect-to-non-www-https.redirectregex.replacement=https://$${1}
        - traefik.http.middlewares.redirect-to-non-www-https.redirectregex.permanent=true

        # Extra middleware
        - traefik.http.middlewares.traefik-ratelimit.ratelimit.average=100
        - traefik.http.middlewares.traefik-ratelimit.ratelimit.burst=50
    volumes:
      - /data/traefik/certificates:/certificates
      - /data/traefik/certificates/origin:/certificates/origin:ro
      - /deployments/traefik/certificates.yaml:/certificates.yaml:ro
      - /var/run/docker.sock:/var/run/docker.sock:ro
    networks:
      - cloud-public
      - cftunnel-transport