services:
  traefik:
    image: traefik:latest
    container_name: traefik
    restart: always
    ports:
      - "80:80"      # HTTP
      - "443:443"    # HTTPS
      # - "8080:8080" # Dashboard (exponer solo si lo proteges)
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - ./traefik.yml:/traefik.yml:ro
      - ./letsencrypt:/letsencrypt
      - ./dynamic:/etc/traefik/dynamic:ro
    environment:
      TZ: "Europe/Madrid"
    networks:
      - proxy
    labels:
      - "traefik.enable=true"
      # Dashboard seguro por dominio
      - "traefik.http.routers.traefik.rule=Host(`traefik.tudominio.com`)"  # EDITA CON TU DOMINIO
      - "traefik.http.routers.traefik.entrypoints=websecure"
      - "traefik.http.routers.traefik.tls=true"
      - "traefik.http.routers.traefik.tls.certresolver=letsencrypt"
      - "traefik.http.routers.traefik.service=api@internal"
      # Autenticación básica (usa middleware del archivo dynamic/middlewares.yml)
      - "traefik.http.routers.traefik.middlewares=auth-basic@file"

networks:
  proxy:
    external: true