docker-compose.yaml

version: '3.9'
services:
  traefik:
    image: traefik:latest
    restart: unless-stopped
    command:
      - "--api.insecure=false"
      - "--entrypoints.web.address=:80"
      # force http to https redirection
      # - "--entrypoints.web.http.redirections.entryPoint.to=web-secure"
      # - "--entrypoints.web.http.redirections.entryPoint.scheme=https"
      - "--entrypoints.web-secure.address=:443"
      - "--log.filePath=/logs/traefik.log"
      - "--log.level=DEBUG"
      - "--log.format=json"
      - "--api.dashboard=true"
      - "--providers.docker=true"
      - "--providers.file.watch=true"
      - "--providers.file.directory=/FileProvider/"
      - "--providers.docker.endpoint=unix:///var/run/docker.sock"
      - "--providers.docker.exposedbydefault=false"
      - "--serverstransport.insecureskipverify=false"
      - "--certificatesresolvers.le.acme.dnschallenge=true"
      - "--certificatesresolvers.le.acme.dnschallenge.provider=cloudflare"
      - "--certificatesresolvers.le.acme.dnschallenge.delaybeforecheck=10"
      - "--certificatesresolvers.le.acme.dnschallenge.resolvers=1.1.1.1:53"
      - "--accesslog.filepath=/logs/access.log"
      - "--metrics.prometheus=true"
      - "--metrics.prometheus.buckets=0.1,0.3,1.2,5.0"
      - "--metrics.prometheus.manualrouting=true"
      - "--metrics.prometheus.entryPoint=metrics"
      - "--metrics.prometheus.addrouterslabels=true"
      - "--tracing.datadog=true"
    environment:
      CF_API_EMAIL: ${CF_API_EMAIL}
      CF_API_KEY: ${CF_API_KEY}
      CF_DNS_API_TOKEN: ${CF_DNS_API_TOKEN}
    container_name: traefik
    labels:
      - "traefik.enable=true"
      # dashboard (optional, this will be the main entrypoint for traefik dashboard)
      - "traefik.http.routers.traefik-rtr.rule=Host(`traefik.${CF_DOMAIN}`)"
      - "traefik.http.routers.traefik-rtr.entrypoints=web-secure"
      - "traefik.http.routers.traefik-rtr.tls=true"
      - "traefik.http.routers.traefik-rtr.tls.certresolver=le"
      - "traefik.http.routers.traefik-rtr.service=api@internal"
    ports:
      # web entrypoint 
      - target: 80
        published: 80
        protocol: tcp
        mode: host
      # web-secure entrypoint
      - target: 443
        published: 443
        protocol: tcp
        mode: host
      # dashboard entrypoint
      - target: 8080
        published: 8080
        protocol: tcp
        mode: host 
    volumes:
      - "/var/run/docker.sock:/var/run/docker.sock" # So Traefik can listen to the Docker events
      - ./FileProvider/:/FileProvider/ # The dynamic configuration file
      - ./logs/:/logs/ 
  # Cloudflare automatic CNAME DNS creation
  cf-companion:
    container_name: cf-companion
    image: tiredofit/traefik-cloudflare-companion:latest
    restart: unless-stopped
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
    environment:
      - TIMEZONE=${TZ}
      - CF_EMAIL=${CF_API_EMAIL}
      - CF_TOKEN=${CF_API_KEY}
      - TARGET_DOMAIN=ddns.${CF_DOMAIN}
      - DOMAIN1=${CF_DOMAIN}
      - DOMAIN1_ZONE_ID=${CF_DOMAIN_ZONE_ID}
      - DOMAIN1_PROXIED=true
    # # Add hosts specified in rules here to force cf-companion to create the CNAMEs
    # labels:
    #   # Since cf-companion creates CNAMEs based on host rules, this a workaround for non-docker/external apps, or load balancers from fileprovider
    #   - "traefik.http.routers.cf-companion-rtr.rule=HostHeader( HostHeader(`custom.${CF_DOMAIN}`) || HostHeader(`subdomain.${CF_DOMAIN}`))"
  # Cloudflare dynamic DNS
  cf-ddns:
    container_name: cf-ddns
    image: oznu/cloudflare-ddns:latest
    restart: unless-stopped
    environment:
      - API_KEY=${CF_DNS_API_TOKEN}
      - ZONE=${CF_DOMAIN}
      - SUBDOMAIN=ddns
      - PROXIED=true
      - RRTYPE=A
      - DELETE_ON_STOP=false
      - DNS_SERVER=1.1.1.1