services:
  traefik:
    image: traefik:latest
    container_name: traefik
    network_mode: host
    extra_hosts:
      - "host.docker.internal:host-gateway"
    cpus: 1.0
    mem_limit: "1024m"
    mem_reservation: "128m"
    restart: always
    #ports:
    #  - "80:80"     # HTTP
    #  - "443:443"   # HTTPS
    #  - "888:8080" # Traefik Dashboard (optional, password-protect in production!)
    command:
      - "--api.dashboard=true"
      - "--api.insecure=true"  # Remove or secure in prod
      - "--providers.docker=true"
      - "--providers.docker.exposedbydefault=false"
      - "--entrypoints.web.address=:80"
      - "--entrypoints.websecure.address=:443"
      - "--providers.docker.network=web,request"
      - "--providers.file.directory=/etc/traefik/dynamic"
      - "--providers.file.watch=true"
      ##DNS resolver
      - "--certificatesresolvers.myresolver.acme.dnschallenge=true"
      - "--certificatesresolvers.myresolver.acme.dnschallenge.provider=desec"
      - "--certificatesresolvers.myresolver.acme.dnschallenge.delaybeforecheck=90"
      - --certificatesresolvers.myresolver.acme.dnschallenge.resolvers=1.1.1.1:53,8.8.8.8:53
      - "--certificatesresolvers.myresolver.acme.email=admin@mapletree.email"
      - "--certificatesresolvers.myresolver.acme.storage=/letsencrypt/acme.json"
      ##HTTP resolver
      - --certificatesresolvers.le_http.acme.httpchallenge=true
      - --certificatesresolvers.le_http.acme.httpchallenge.entrypoint=web
      - --certificatesresolvers.le_http.acme.email=admin@mapletree.email
      - --certificatesresolvers.le_http.acme.storage=/letsencrypt/acme.json
    environment:
    # Pass the variables through
      - DESEC_TOKEN=${DESEC_TOKEN}
      - DESEC_DOMAIN=${DESEC_DOMAIN}
      # (Any other Traefik env vars you need)
    volumes:
      - "/var/run/docker.sock:/var/run/docker.sock:ro"
      - "/docker/core/traefik/letsencrypt:/letsencrypt"
      - "${REPO_ROOT}/traefik/dynamic:/etc/traefik/dynamic"