services:
  traefik:
    image: traefik:latest
    restart: unless-stopped

    command:
      - --api.dashboard=true
      - --api.insecure=true

      - --providers.docker=true
      - --providers.docker.exposedbydefault=false

      - --entrypoints.web.address=:80
      - --entrypoints.websecure.address=:443

      - --certificatesresolvers.cloudflare.acme.dnschallenge=true
      - --certificatesresolvers.cloudflare.acme.dnschallenge.provider=cloudflare
      - --certificatesresolvers.cloudflare.acme.email=${ADM_EMAIL}
      - --certificatesresolvers.cloudflare.acme.storage=/letsencrypt/acme.json

      - --entrypoints.websecure.forwardedHeaders.trustedIPs=173.245.48.0/20,103.21.244.0/22,103.22.200.0/22,103.31.4.0/22,141.101.64.0/18,108.162.192.0/18,190.93.240.0/20,188.114.96.0/20,197.234.240.0/22,198.41.128.0/17,162.158.0.0/15,104.16.0.0/13,104.24.0.0/14,172.64.0.0/13,131.0.72.0/22
      - --entrypoints.websecure.forwardedHeaders.insecure=true
 
    ports:
      - 80:80
      - 443:443

    environment:
      - CF_DNS_API_TOKEN=${CF_DNS_API_TOKEN}

    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - /home/docker/DenRoute/letsencrypt:/letsencrypt

    networks:
      tan-network:
        ipv4_address: 10.10.0.20
      nextcloud-aio:

networks:
  tan-network:
    external: true
  nextcloud-aio:
    external: true