# =============================================================================
# Traefik v3.6 — Reverse proxy + SSL Let's Encrypt
#
# Deux certresolvers :
#  - letsencrypt      : DNS-01 via OVH (zone taaazzz-prog.fr) — wildcards possibles
#  - letsencrypt-http : HTTP-01 — pour domaines sans acces API OVH (ex: coolcare.fr)
#
# Le redirect HTTP→HTTPS au niveau entrypoint a ete RETIRE (2026-05-15) car il
# captait aussi /.well-known/acme-challenge/ et bloquait HTTP-01. Chaque stack
# a deja son propre router HTTP + middleware redirectscheme pour gerer le
# redirect (cf. coolcare-stack.yml, missioflow, faildaily, iliacloud).
# =============================================================================

services:
  traefik:
    image: traefik:v3.6
    command:
      - "--api.dashboard=true"
      - "--providers.swarm=true"
      - "--providers.swarm.exposedbydefault=false"
      - "--providers.swarm.endpoint=unix:///var/run/docker.sock"
      - "--entrypoints.web.address=:80"
      - "--entrypoints.websecure.address=:443"
      # Redirect HTTP→HTTPS au niveau entrypoint. Coexiste avec HTTP-01 :
      # Traefik insère un router interne sur /.well-known/acme-challenge/ en
      # priorité maximale, qui intercepte AVANT cette redirection.
      - "--entrypoints.web.http.redirections.entrypoint.to=websecure"
      - "--entrypoints.web.http.redirections.entrypoint.scheme=https"
      - "--entrypoints.web.http.redirections.entrypoint.permanent=true"
      - "--certificatesresolvers.letsencrypt.acme.email=contact@taaazzz-prog.fr"
      - "--certificatesresolvers.letsencrypt.acme.storage=/certificates/acme.json"
      - "--certificatesresolvers.letsencrypt.acme.dnschallenge=true"
      - "--certificatesresolvers.letsencrypt.acme.dnschallenge.provider=ovh"
      - "--certificatesresolvers.letsencrypt.acme.dnschallenge.delaybeforecheck=10"
      - "--certificatesresolvers.letsencrypt-http.acme.email=contact@taaazzz-prog.fr"
      - "--certificatesresolvers.letsencrypt-http.acme.storage=/certificates/acme-http.json"
      - "--certificatesresolvers.letsencrypt-http.acme.httpchallenge=true"
      - "--certificatesresolvers.letsencrypt-http.acme.httpchallenge.entrypoint=web"
    env_file:
      - /home/ubuntu/.ovh-api-credentials
    deploy:
      replicas: 1
      placement:
        constraints:
          - node.role == manager
      labels:
        - "traefik.enable=false"
        - "traefik.http.services.traefik.loadbalancer.server.port=8080"
    ports:
      - target: 80
        published: 80
        protocol: tcp
        mode: host
      - target: 443
        published: 443
        protocol: tcp
        mode: host
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - traefik-certificates:/certificates
    networks:
      - traefik-public

volumes:
  traefik-certificates:

networks:
  traefik-public:
    external: true
