version: "3.7"                                                                                                                                                                                                                                                                                                                                                                                                                                        ########################### NETWORKS                                                                                                                                                                                       networks:                                                                                                                                                                                                                    t2_proxy:                                                                                                                                                                                                                    external:                                                                                                                                                                                                                    name: t2_proxy                                                                                                                                                                                                         default:                                                                                                                                                                                                                     driver: bridge                                                                                                                                                                                                                                                                                                                                                                                                                                    ########################### SERVICES                                                                                                                                                                                       services:                                                                                                                                                                                                                  # All services / apps go below this line                                                                                                                                                                                   # Traefik 2 - Reverse Proxy                                                                                                                                                                                                  traefik:                                                                                                                                                                                                                     container_name: traefik                                                                                                                                                                                                    image: traefik:2.2.1 # the chevrotin tag refers to v2.2.x but introduced a breaking change in 2.2.2                                                                                                                        restart: unless-stopped                                                                                                                                                                                                    command: # CLI arguments                                                                                                                                                                                                     - --global.checkNewVersion=true                                                                                                                                                                                            - --global.sendAnonymousUsage=true                                                                                                                                                                                         - --entryPoints.http.address=:80                                                                                                                                                                                           - --entryPoints.https.address=:443                                                                                                                                                                                           # Allow these IPs to set the X-Forwarded-* headers - Cloudflare IPs: https://www.cloudflare.com/ips/                                                                                                                     - --entrypoints.https.forwardedHeaders.trustedIPs=173.245.48.0/20,103.21.244.0/22,103.22.200.0/22,103.31.4.0/22,141.101.64.0/18,108.162.192.0/18,190.93.240.0/20,188.114.96.0/20,197.234.240.0/22,198.41.128.0/17,162.158.0.0/15,104.16.0.0/12,172.64.0.0/13,131.0.72.0/22                                                                                                                                                                            - --entryPoints.traefik.address=:8080                                                                                                                                                                                      - --api=true                                                                                                                                                                                                         #      - --api.insecure=true                                                                                                                                                                                               #      - --serversTransport.insecureSkipVerify=true                                                                                                                                                                              - --log=true                                                                                                                                                                                                               - --log.level=DEBUG # (Default: error) DEBUG, INFO, WARN, ERROR, FATAL, PANIC                                                                                                                                              - --accessLog=true                                                                                                                                                                                                         - --accessLog.filePath=/traefik.log                                                                                                                                                                                        - --accessLog.bufferingSize=100 # Configuring a buffer of 100 lines                                                                                                                                                        - --accessLog.filters.statusCodes=400-499                                                                                                                                                                                  - --providers.docker=true                                                                                                                                                                                                  - --providers.docker.endpoint=unix:///var/run/docker.sock                                                                                                                                                                  - --providers.docker.defaultrule=Host(`{{ index .Labels "com.docker.compose.service" }}.$DOMAINNAME`)                                                                                                                      - --providers.docker.exposedByDefault=false                                                                                                                                                                                - --providers.docker.network=t2_proxy                                                                                                                                                                                      - --providers.docker.swarmMode=false                                                                                                                                                                                       - --providers.file.directory=/rules # Load dynamic configuration from one or more .toml or .yml files in a directory.                                                                                                #      - --providers.file.filename=/path/to/file # Load dynamic configuration from a file.                                                                                                                                       - --providers.file.watch=true # Only works on top level files in the rules folder                                                                                                                                          - --certificatesResolvers.dns-cloudflare.acme.caServer=https://acme-staging-v02.api.letsencrypt.org/directory # LetsEncrypt Staging Server - uncomment when testing                                                        - --certificatesResolvers.dns-cloudflare.acme.email=$CLOUDFLARE_EMAIL                                                                                                                                                      - --certificatesResolvers.dns-cloudflare.acme.storage=/acme.json                                                                                                                                                           - --certificatesResolvers.dns-cloudflare.acme.dnsChallenge.provider=cloudflare                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                             #    networks:                                                                                                                                                                                                             #      t2_proxy:                                                                                                                                                                                                           #        ipv4_address: 192.168.90.254 # You can specify a static IP                                                                                                                                                            networks:                                                                                                                                                                                                                    - t2_proxy                                                                                                                                                                                                                                                                                                                                                                                                                                          security_opt:                                                                                                                                                                                                                - no-new-privileges:true                                                                                                                                                                                                                                                                                                                                                                                                                            ports:                                                                                                                                                                                                                       - "80:80/tcp"                                                                                                                                                                                                              - "443:443/tcp"                                                                                                                                                                                                            - "8081:8080/tcp"                                                                                                                                                                                                                                                                                                                                                                                                                                   volumes:                                                                                                                                                                                                                     - $DOCKERDIR/traefik2/rules:/rules                                                                                                                                                                                         - /var/run/docker.sock:/var/run/docker.sock:ro                                                                                                                                                                             - $DOCKERDIR/traefik2/acme/acme.json:/acme.json                                                                                                                                                                            - $DOCKERDIR/traefik2/traefik.log:/traefik.log                                                                                                                                                                             - $DOCKERDIR/shared:/shared                                                                                                                                                                                                                                                                                                                                                                                                                         environment:                                                                                                                                                                                                                 - CF_API_EMAIL=$CLOUDFLARE_EMAIL                                                                                                                                                                                           - CF_API_KEY=$CLOUDFLARE_API_KEY                                                                                                                                                                                                                                                                                                                                                                                                                    labels:                                                                                                                                                                                                                      - "traefik.enable=true"                                                                                                                                                                                                                                                                                                                                                                                                                               # HTTP-to-HTTPS Redirect                                                                                                                                                                                                   - "traefik.http.routers.http-catchall.entrypoints=http"                                                                                                                                                                    - "traefik.http.routers.http-catchall.rule=HostRegexp(`{host:.+}`)"                                                                                                                                                        - "traefik.http.routers.http-catchall.middlewares=redirect-to-https"                                                                                                                                                       - "traefik.http.middlewares.redirect-to-https.redirectscheme.scheme=https"                                                                                                                                                                                                                                                                                                                                                                            # HTTP Routers                                                                                                                                                                                                             - "traefik.http.routers.traefik-rtr.entrypoints=https"                                                                                                                                                                     - "traefik.http.routers.traefik-rtr.rule=Host(`traefik.$DOMAINNAME`)"                                                                                                                                                      - "traefik.http.routers.traefik-rtr.tls=true"                                                                                                                                                                        #      - "traefik.http.routers.traefik-rtr.tls.certresolver=dns-cloudflare" # Comment out this line after first run of traefik to force the use of wildcard certs                                                                - "traefik.http.routers.traefik-rtr.tls.domains[0].main=$DOMAINNAME"                                                                                                                                                       - "traefik.http.routers.traefik-rtr.tls.domains[0].sans=*.$DOMAINNAME"                                                                                                                                               #      - "traefik.http.routers.traefik-rtr.tls.domains[1].main=$SECONDDOMAINNAME" # Pulls main cert for second domain                                                                                                      #      - "traefik.http.routers.traefik-rtr.tls.domains[1].sans=*.$SECONDDOMAINNAME" # Pulls wildcard cert for second domain                                                                                                                                                                                                                                                                                                                                 ## Services - API                                                                                                                                                                                                          - "traefik.http.routers.traefik-rtr.service=api@internal"                                                                                                                                                                                                                                                                                                                                                                                             ## Middlewares                                                                                                                                                                                                             - "traefik.http.routers.traefik-rtr.middlewares=middlewares-basic-auth@file"