services:
  traefik:
    image: traefik:latest
    restart: unless-stopped

    command:
      - --api.dashboard=true
      - --api.insecure=true

      - --providers.docker=true
      - --providers.docker.endpoint=unix:///var/run/docker.sock
      - --providers.docker.exposedbydefault=false

      - --entrypoints.web.address=:80
      - --entrypoints.websecure.address=:443

      - --serversTransport.insecureSkipVerify=true

      # ✅ Cloudflare DNS challenge
      - --certificatesresolvers.cloudflare.acme.dnschallenge=true
      - --certificatesresolvers.cloudflare.acme.dnschallenge.provider=cloudflare
      - --certificatesresolvers.cloudflare.acme.email=${ADM_EMAIL}
      - --certificatesresolvers.cloudflare.acme.storage=/letsencrypt/acme.json

      # ✅ Trust Cloudflare
      - --entrypoints.websecure.forwardedHeaders.trustedIPs=173.245.48.0/20,103.21.244.0/22,103.22.200.0/22,103.31.4.0/22,141.101.64.0/18,108.162.192.0/18,190.93.240.0/20,188.114.96.0/20,197.234.240.0/22,198.41.128.0/17,162.158.0.0/15,104.16.0.0/13,104.24.0.0/14,172.64.0.0/13,131.0.72.0/22
      - --entrypoints.websecure.forwardedHeaders.insecure=true

      - --log.level=INFO

      - --accesslog=true
      - --accesslog.filepath=/logs/traefik.log
      - --accesslog.format=json

      - --accesslog.filters.statuscodes=200-299,400-599

      - --accesslog.fields.headers.defaultmode=drop
      - --accesslog.fields.headers.names.User-Agent=keep
      - --accesslog.fields.headers.names.X-Real-Ip=keep
      - --accesslog.fields.headers.names.X-Forwarded-For=keep
      - --accesslog.fields.headers.names.X-Forwarded-Proto=keep

    labels:
      - traefik.enable=true

      # =========================
      # 🔐 AUTHENTIK FORWARD AUTH
      # =========================
      - traefik.http.middlewares.authentik.forwardauth.address=http://authentik-proxy:9000/outpost.goauthentik.io/auth/traefik
      - traefik.http.middlewares.authentik.forwardauth.trustForwardHeader=true
      - traefik.http.middlewares.authentik.forwardauth.authResponseHeaders=X-authentik-username,X-authentik-groups,X-authentik-email,X-authentik-name,X-authentik-uid

      # =========================
      # 🏠 LOCAL BYPASS (optionnel)
      # =========================
      - traefik.http.middlewares.local-ipwhitelist.ipwhitelist.sourcerange=10.0.0.0/8,192.168.0.0/16

      # =========================
      # 🔗 GLOBAL CHAIN
      # =========================
      # 👉 AVEC bypass LAN :
      - traefik.http.middlewares.chain-auth.chain.middlewares=local-ipwhitelist,authentik

      # 👉 SI tu veux FORCER auth partout (sans bypass LAN) :
      # - traefik.http.middlewares.chain-auth.chain.middlewares=authentik

    ports:
      - 80:80
      - 443:443

    environment:
      - CF_DNS_API_TOKEN=${CF_DNS_API_TOKEN}
      - TZ=Europe/Paris

    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - /home/docker/DenRoute/letsencrypt:/letsencrypt
      - /home/docker/DenRoute/logs:/logs:rw

    networks:
      tan-network:
        ipv4_address: 10.10.0.20
      nextcloud-aio:

networks:
  tan-network:
    external: true
  nextcloud-aio:
    external: true