# Traefik Static Configuration
# Copy to /opt/stacks/traefik/traefik.yml

global:
  checkNewVersion: true
  sendAnonymousUsage: false

api:
  dashboard: true
  insecure: false  # Dashboard accessible via Traefik route with Authelia

entryPoints:
  web:
    address: ":80"
    http:
      redirections:
        entryPoint:
          to: websecure
          scheme: https
  
  websecure:
    address: ":443"
    http:
      tls:
        certResolver: letsencrypt

certificatesResolvers:
  letsencrypt:
    acme:
      email: ACME_EMAIL_PLACEHOLDER  # Will be replaced by deploy script
      storage: /acme.json
      # HTTP challenge - Simple setup, port 80 must be accessible
      # Works for individual domain certificates
      httpChallenge:
        entryPoint: web
      # DNS challenge - For wildcard certificates (advanced)
      # Uncomment and comment out httpChallenge to use:
      # dnsChallenge:
      #   provider: duckdns
      #   resolvers:
      #     - "1.1.1.1:53"
      #     - "8.8.8.8:53"

providers:
  docker:
    endpoint: "unix:///var/run/docker.sock"
    exposedByDefault: false  # Only expose services with traefik.enable=true
    network: traefik-network
  
  file:
    directory: /dynamic
    watch: true

log:
  level: INFO  # DEBUG, INFO, WARN, ERROR
  filePath: /var/log/traefik/traefik.log

accessLog:
  filePath: /var/log/traefik/access.log
  bufferingSize: 100