docker-traefik/docker-compose.yml

name: traefik

### networks
networks:
  back_network:
    driver: bridge
    attachable: true
    ipam:
      config:
        - subnet: 10.0.111.0/29
  front_network:
    driver: bridge
    attachable: true
    ipam:
      config:
        - subnet: 10.0.110.0/24
  socket_proxy_network:
    driver: bridge
    attachable: true
    name: socket_proxy_network
    internal: true
    ipam:
      config:
        - subnet: 10.0.120.0/24
  cloudflare_network:
    driver: bridge
    name: cloudflare_network
    ipam:
      config:
        - subnet: 10.0.100.0/29
  monitoring_network:
    external: true
    name: monitoring_network


### services
services:
## traefik
  traefik:
    container_name: traefik-app
    hostname: traefik-app
    image: traefik:latest
    restart: always
    ports:
#      - "22:22"         # SSH
      - "80:80"         # HTTP
      - "443:443"       # HTTPS
      - "8181:8181"     #
      - "9090:9090"     #
      - "9091:9091/udp" #
#      - "3841:3841"     #
#      - "25:25"         # SMTP  (explicit TLS => STARTTLS, Authentication is DISABLED => use port 465/587 instead)
#      - "143:143"       # IMAP4 (explicit TLS => STARTTLS)
#      - "465:465"       # ESMTP (implicit TLS)
#      - "587:587"       # ESMTP (explicit TLS => STARTTLS)
#      - "993:993"       # IMAP4 (implicit TLS)
    volumes:
      - "/var/run/docker.sock:/var/run/docker.sock:ro"
      - "/etc/localtime:/etc/localtime:ro"
      - "./configs/traefik.yml:/etc/traefik/traefik.yml"
      - "./configs/dynamic:/etc/traefik/dynamic:rw"
      - "./certificates:/var/traefik/certs:rw"
      - "./certificates:/etc/traefik/ssl:rw"
      - "./certificates:/certs:ro"
      - "./logs:/var/log/traefik:rw"
      - "./acme:/etc/traefik/acme:rw"
      - "./crowdsec/lapi-key:/etc/traefik/lapi-key:ro"
    environment:
      - CF_DNS_API_TOKEN=${CF_DNS_API_TOKEN}
      - CLOUDFLARE_HTTP_TIMEOUT=${HTTP_TIMEOUT}
      - CLOUDFLARE_POLLING_INTERVAL=${POLLING_INTERVAL}
      - CLOUDFLARE_PROPAGATION_TIMEOUT=${PROPAGATION_TIMEOUT}
      - CLOUDFLARE_TTL=${TTL}
    networks:
      - back_network
      - front_network
      - cloudflare_network
      - monitoring_network
    healthcheck:
      test: ["CMD", "traefik", "healthcheck", "--ping"]
      interval: 30s
      timeout: 5s
      retries: 3
      start_period: 20s
    labels:
      - "com.centurylinklabs.watchtower.enable=true"
      - "fathom.vault.CF_DNS_API_TOKEN=secret/cloudflare"

## Certificats
  certificat:
    container_name: traefik-certificat
    hostname: traefik-certificat
    image: alpine:latest
    command: sh -c "cd /etc/traefik/ssl
      && wget traefik.me/cert.pem -O cert2.pem
      && wget traefik.me/privkey.pem -O privkey2.pem"
    volumes:
      - "./certificates:/etc/traefik/ssl"
    networks:
      - front_network
    labels:
      - "com.centurylinklabs.watchtower.enable=true"

## Cloudflare:
  cloudflare:
    container_name: cloudflared-tunnel
    hostname: cloudflared-tunnel
    image: cloudflare/cloudflared:latest
    restart: unless-stopped
    command: tunnel run --protocol http2
    volumes:
      - "/etc/localtime:/etc/localtime:ro"
    environment:
      - TZ=Europe/Paris
      - TUNNEL_TOKEN=${CF_TUNNEL_TOKEN}
    networks:
      - cloudflare_network
    security_opt:
      - no-new-privileges
    cap_drop:
      - ALL
    cap_add:
      - NET_BIND_SERVICE
    read_only: true
    tmpfs:
      - /tmp
    deploy:
      resources:
        limits:
          cpus: '0.5'
          memory: 512M
        reservations:
          cpus: '0.25'
          memory: 256M
    labels:
      - "com.centurylinklabs.watchtower.enable=true"

## Crowdsec:
  crowdsec:
    container_name: crowdsec-app
    hostname: crowdsec-app
    image: crowdsecurity/crowdsec:latest
    restart: unless-stopped
    volumes:
      - "./crowdsec/acquis.yaml:/etc/crowdsec/acquis.yaml"
      - "./logs:/var/log/traefik/:ro"
      - "./crowdsec-db:/var/lib/crowdsec/data/"
      - "./crowdsec-config:/etc/crowdsec/"
    environment:
      COLLECTIONS: "crowdsecurity/linux crowdsecurity/traefik"
      GID: "1000"
      PROMETHEUS: "true"
    networks:
      - back_network
      - monitoring_network
    healthcheck:
      test: ["CMD", "cscli", "lapi", "status"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 60s

## socket-proxy:
  socket-proxy:
    container_name: socket-proxy
    hostname: socket-proxy
    image: ghcr.io/tecnativa/docker-socket-proxy:latest
    restart: always
    environment:
      - CONTAINERS=1
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
    networks:
      - socket_proxy_network
    security_opt:
      - no-new-privileges:true
    labels:
      - "com.centurylinklabs.watchtower.enable=true"
      - "fathom.exempt.socket-docker=proxy de socket filtrant, c'est sa raison d'etre"

## error-pages:
#  error-pages:
#    image: ghcr.io/tarampampam/error-pages:3
#    container_name: traefik-error-pages
#    environment:
#      - TEMPLATE_NAME=l7
#    networks:
#      - front_network
#    restart: unless-stopped

## whoami:
  whoami:
    container_name: traefik-whoami
    hostname: traefik-whoami
    image: traefik/whoami:latest
    restart: unless-stopped
    command:
      - --name=externe
    networks:
      - front_network
    labels:
      - "com.centurylinklabs.watchtower.enable=true"
      - "traefik.enable=true"
      - "traefik.docker.network=front_network"
# HTTP
      - "traefik.http.routers.whoami-http.rule=Host(`whoami.tips-of-mine.com`)"
      - "traefik.http.routers.whoami-http.entrypoints=http"
# HTTPS
      - "traefik.http.routers.whoami-https.rule=Host(`whoami.tips-of-mine.com`)"
      - "traefik.http.routers.whoami-https.entrypoints=https"
      - "traefik.http.routers.whoami-https.tls=true"
      - "traefik.http.routers.whoami-https.service=whoami-service"
# Middleware
# Service
      - "traefik.http.services.whoami-service.loadbalancer.server.port=80"
# Homepage
      - "homepage.group=Tools"
      - "homepage.name=whoami"
      - "homepage.icon=whoami.png"
      - "homepage.href=https://whoami.tips-of-mine.com"
      - "homepage.description=whoami"

## whoami-tcp:
  whoami-tcp:
    image: traefik/whoamitcp:latest
    container_name: traefik-whoami-tcp
    command:
      - "-name=traefik-whoami-tcp"
    networks:
      - front_network
    restart: unless-stopped
    labels:
      - "traefik.enable=true"
#      - "traefik.docker.network=front_network"
      - "traefik.tcp.routers.whoami-tcp.entrypoints=tcptest"
      - "traefik.tcp.routers.whoami-tcp.rule=HostSNI(`*`)"
      - "traefik.tcp.services.whoami-tcp.loadbalancer.server.port=8080"

## whoami-udp:
  whoami-udp:
    image: traefik/whoamiudp:latest
    container_name: traefik-whoami-udp
    command:
      - "-name=traefik-whoami-udp"
    networks:
      - front_network
    restart: unless-stopped
    labels:
      - "traefik.enable=true"
      - "traefik.udp.routers.whoami-udp.entrypoints=udptest"
      - "traefik.udp.services.whoami-udp.loadbalancer.server.port=8080"