docker-compose.yaml

services:
  traefik:
    image: traefik
    restart: unless-stopped
    command:
      #- "--log.level=DEBUG"
      #- "--accesslog=true"
      - "--api.insecure=true"
      - "--providers.docker.exposedbydefault=false"
      - "--providers.docker.defaultRule=Host(`{{ index .Labels \"com.docker.compose.service\" }}.$DOMAINNAME`)"
      - "--providers.file.filename=/etc/traefik/traefik_config.yml"
      - "--entrypoints.http.address=:443"
      - "--entrypoints.http.http3=true"
      - "--entrypoints.http.http.tls.certResolver=letsencrypt"
      - "--entrypoints.http.http.middlewares=hsts@file,compression@file"
      - "--certificatesResolvers.letsencrypt.acme.email=$ACMEMAIL"
      - "--certificatesResolvers.letsencrypt.acme.storage=acme.json"
      - "--certificatesResolvers.letsencrypt.acme.dnsChallenge.provider=desec"
    networks: 
      - traefik
    ports:
      - 443:443
      - 443:443/udp
      - 9080:8080
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - ./traefik_config.yml:/etc/traefik/traefik_config.yml
      - ./acme.json:/acme.json
    environment: 
      - DESEC_TOKEN
      - DOMAINNAME
      - GARMIN_BASIC_PW
    labels:
      - "com.centurylinklabs.watchtower.monitor-only=true"

  auth:
    image: ghcr.io/stefanschoof/traefik-forward-auth:2
    restart: unless-stopped
    networks:
      - traefik
    environment:
#      - LOG_LEVEL=debug
      - PROVIDERS_GOOGLE_CLIENT_ID
      - PROVIDERS_GOOGLE_CLIENT_SECRET
      - SECRET
      - COOKIE_DOMAIN=$DOMAINNAME
      - AUTH_HOST=auth.$DOMAINNAME
      - LIFETIME=2592000 # 30 days
      - WHITELIST
    command:
      # manifest json will be downloaded in default without cookie.
      # Since this is not private, disable auth for it
      - "--rule.manifest.action=allow"
      - "--rule.manifest.rule=Path(`/manifest.json`) || Path(`/icon.png`) || PathPrefix(`/meta`) || PathPrefix(`/ico`)"
    labels:
      - "traefik.enable=true"
      - "traefik.http.middlewares.auth.forwardauth.address=http://auth:4181"
      - "traefik.http.middlewares.auth.forwardauth.authResponseHeaders=X-Forwarded-User"
      - "traefik.http.services.auth.loadbalancer.server.port=4181"
      - "com.centurylinklabs.watchtower.monitor-only=true"


  test:
    image: containous/whoami
    restart: unless-stopped
    networks:
      - traefik
    labels:
      - "traefik.enable=true"
      - "traefik.http.services.test.loadbalancer.server.port=80"
      - "traefik.http.routers.test.middlewares=auth"

networks:
  traefik:
    name: traefik