services:

  proxy:
    restart: always
    ports:
      # Listen on port 80, default for HTTP, necessary to redirect to HTTPS
      - "80:80"
      # Listen on port 443, default for HTTPS
      - "443:443"
    volumes:
      # Mount the volume to store the certificates
      - traefik-certificates:/certificates
    command:
      # Enable Docker in Traefik, so that it reads labels from Docker services
      - --providers.docker
      # Do not expose all Docker services, only the ones explicitly exposed
      - --providers.docker.exposedbydefault=false
      # Create an entrypoint "http" listening on port 80
      - --entrypoints.http.address=:80
      # Redirect all HTTP traffic to HTTPS
      - --entrypoints.http.http.redirections.entrypoint.to=https
      - --entrypoints.http.http.redirections.entrypoint.scheme=https
      # Create an entrypoint "https" listening on port 443
      - --entrypoints.https.address=:443
      # Store the Let's Encrypt certificates in the mounted volume
      - --certificatesresolvers.le.acme.storage=/certificates/acme.json
      # Use the TLS Challenge for Let's Encrypt
      - --certificatesresolvers.le.acme.tlschallenge=true
      # Enable the access log, with HTTP requests
      - --accesslog
      # Enable the Traefik log, for configurations and errors
      - --log

  db:
    restart: always

  adminer:
    restart: always
    labels:
      # Route HTTPS traffic for the Adminer subdomain
      - traefik.http.routers.adminer-https.rule=Host(`adminer.${DOMAIN?Variable not set}`)
      - traefik.http.routers.adminer-https.entrypoints=https
      - traefik.http.routers.adminer-https.tls=true
      # Use the Let's Encrypt resolver
      - traefik.http.routers.adminer-https.tls.certresolver=le

  prestart:
    environment:
      FRONTEND_HOST: https://${DOMAIN?Variable not set}

  backend:
    restart: always
    environment:
      FRONTEND_HOST: https://${DOMAIN?Variable not set}
    labels:
      # Route HTTPS traffic for this domain
      - traefik.http.routers.backend-https.rule=Host(`${DOMAIN?Variable not set}`)
      - traefik.http.routers.backend-https.entrypoints=https
      - traefik.http.routers.backend-https.tls=true
      # Use the Let's Encrypt resolver
      - traefik.http.routers.backend-https.tls.certresolver=le

volumes:
  # Create a volume to store the certificates, even if the container is recreated
  traefik-certificates: