docker-compose.yaml

x-healthcheck: &healthcheck
  interval: 30s
  timeout: 5s
  retries: 15
  start_period: 3s
  start_interval: 1s

networks:
  proxy:
    name: traefik_proxy
    driver: bridge

volumes:
  step:
  acme:

services:
  stepca-init:
    container_name: traefik_stepca_init
    image: smallstep/step-ca:${STEPCA_VER?:}
    restart: no
    entrypoint: /bin/bash
    command: /entrypoint.sh
    environment:
      - DOCKER_STEPCA_INIT_NAME
      - DOCKER_STEPCA_INIT_DNS_NAMES
      - DOCKER_STEPCA_INIT_REMOTE_MANAGEMENT
      - DOCKER_STEPCA_INIT_ACME
    volumes:
      - step:/home/step

  stepca:
    container_name: traefik_stepca
    image: smallstep/step-ca:${STEPCA_VER?:}
    restart: unless-stopped
    environment:
      - DOCKER_STEPCA_INIT_NAME
      - DOCKER_STEPCA_INIT_DNS_NAMES
      - DOCKER_STEPCA_INIT_REMOTE_MANAGEMENT
      - DOCKER_STEPCA_INIT_ACME
    volumes:
      - step:/home/step
      - ${PWD}/step/config/ca.json:/home/step/config/ca.json:ro
    network_mode: host
    depends_on:
      stepca-init:
        condition: service_completed_successfully
    healthcheck:
      <<: *healthcheck
      test: [CMD-SHELL, "curl -fk https://localhost:9000/health"]

  traefik:
    container_name: traefik
    image: traefik:${TRAEFIK_VER?:}
    command: --configFile=/etc/traefik/traefik-static.yaml
    restart: unless-stopped
    networks:
      proxy:
        aliases:
          - traefik.docker.local
    ports:
      # HTTP web entrypoint for dashboards, web apps, etc.
      - 80:80
      # HTTPS web entrypoint for dashboards, web apps, etc.
      - 443:443
      # Traefik dashboard
      - 8080:8080
      # Shared TCP entrypoint for services
      - 4040:4040
    labels:
      # Enable Traefik discovery for this container
      - "traefik.enable=true"

      # Create a Traefik service on port 8080 for the container
      - "traefik.http.services.${TRAEFIK_PREFIX}_self.loadBalancer.server.port=8080"

      # Expose the service with a Traefik router
      - "traefik.http.routers.${TRAEFIK_PREFIX}_self.rule=Host(`${TRAEFIK_DOMAIN}`)"
      - "traefik.http.routers.${TRAEFIK_PREFIX}_self.tls=true"
      - "traefik.http.routers.${TRAEFIK_PREFIX}_self.entryPoints=${TRAEFIK_HTTPS_ENTRYPOINT}"
      - "traefik.http.routers.${TRAEFIK_PREFIX}_self.tls.certResolver=${TRAEFIK_CERT_RESOLVER}"
      - "traefik.http.routers.${TRAEFIK_PREFIX}_self.service=${TRAEFIK_PREFIX}_self"
    volumes:
      - step:/home/step
      - acme:/acme
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - ${PWD}/traefik/traefik-static.yaml:/etc/traefik/traefik-static.yaml:ro
    environment:
      - LEGO_CA_CERTIFICATES=/home/step/certs/root_ca.crt
    depends_on:
      stepca:
        condition: service_healthy
    extra_hosts:
      - "host.docker.internal:host-gateway"
    healthcheck:
      <<: *healthcheck
      test: [CMD-SHELL, "wget -q --spider http://localhost:8080/ping"]

  dozzle:
    container_name: traefik_dozzle
    image: amir20/dozzle:${DOZZLE_VER?:}
    command: --enable-shell
    restart: unless-stopped
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
    expose:
      - 8080
    networks:
      - proxy
    labels:
      # Enable Traefik discovery for this container
      - "traefik.enable=true"

      # Create a Traefik service on port 8080 for the container
      - "traefik.http.services.${TRAEFIK_PREFIX}_dozzle.loadBalancer.server.port=8080"

      # Expose the service with a Traefik router
      - "traefik.http.routers.${TRAEFIK_PREFIX}_dozzle.rule=Host(`dozzle.${TRAEFIK_DOMAIN}`)"
      - "traefik.http.routers.${TRAEFIK_PREFIX}_dozzle.tls=true"
      - "traefik.http.routers.${TRAEFIK_PREFIX}_dozzle.entryPoints=${TRAEFIK_HTTPS_ENTRYPOINT}"
      - "traefik.http.routers.${TRAEFIK_PREFIX}_dozzle.tls.certResolver=${TRAEFIK_CERT_RESOLVER}"
      - "traefik.http.routers.${TRAEFIK_PREFIX}_dozzle.service=${TRAEFIK_PREFIX}_dozzle"
    depends_on:
      traefik:
        condition: service_healthy
    healthcheck:
      <<: *healthcheck
      test: ["CMD", "/dozzle", "healthcheck"]