---
version: '3.9'
services:
  traefik:
    image: traefik:v2.7
    container_name: traefik
    restart: always
    ports:
      - "443:443"
      - "80:80"
    privileged: true
    volumes:
      - "/var/run/docker.sock:/var/run/docker.sock:z"
      - "./traefik.yaml:/etc/traefik/traefik.yaml:Z,ro"
      - "./dynamic.yaml:/etc/traefik/dynamic.yaml:Z,ro"
      - "acme:/acme"
    networks:
      - gateway
      - default
    environment:
      CLOUDFLARE_DNS_API_TOKEN: "{{ traefik.CLOUDFLARE_DNS_API_TOKEN }}"

  traefik-fa:
    image: thomseddon/traefik-forward-auth:latest
    volumes:
      - ./traefik-fa.ini:/forward.ini:ro,Z
    environment:
      - CONFIG=/forward.ini
    networks:
      - gateway
    depends_on:
      - traefik
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.traefik-fa.rule=Host(`traefik-fa.tobiasmanske.de`)"
      - "traefik.http.routers.traefik-fa.entryPoints=websecure"
      - "traefik.http.services.traefik-fa.loadbalancer.server.port=4181"
      - "traefik.http.routers.traefik-fa.middlewares=sso@file"

  # whoami:
  #   image: containous/whoami
  #   networks:
  #     - gateway
  #   labels:
  #     - "traefik.enable=true"
  #     - "traefik.http.services.whoami.loadbalancer.server.port=80"
  #     - "traefik.http.routers.whoami.rule=Host(`test.tobiasmanske.de`)"
  #     - "traefik.http.routers.whoami.entryPoints=websecure"
  #     - "traefik.http.routers.whoami.middlewares=sso@file"

volumes:
  acme:

networks:
  gateway:
    name: gateway
    internal: false
  default:
    driver: bridge
...