# Traefik pour développement local - copie identique de la prod OVH
traefik:
  image: traefik:v2.10
  container_name: web-sentinel-traefik-local
  restart: unless-stopped
  command:
    - "--api.dashboard=true"
    - "--api.insecure=true"
    - "--entrypoints.web.address=:80"
    - "--entrypoints.websecure.address=:443"
    - "--entrypoints.web.http.redirections.entrypoint.to=websecure"
    - "--entrypoints.web.http.redirections.entrypoint.scheme=https"
    - "--providers.docker=true"
    - "--providers.docker.exposedbydefault=false"
    - "--providers.docker.network=faildaily_faildaily-ssl-network"
    - "--certificatesresolvers.letsencrypt.acme.email=bruno@taaazzz.be"
    - "--certificatesresolvers.letsencrypt.acme.storage=/letsencrypt/acme.json"
    - "--certificatesresolvers.letsencrypt.acme.httpchallenge=true"
    - "--certificatesresolvers.letsencrypt.acme.httpchallenge.entrypoint=web"
    - "--certificatesresolvers.letsencrypt.acme.keyType=EC256"
    - "--log.level=INFO"
    - "--accesslog=true"
    - "--entrypoints.websecure.http.middlewares=security-headers@docker"
  ports:
    - "80:80"
    - "443:443"
    - "8080:8080"  # Dashboard Traefik
  volumes:
    - //var/run/docker.sock:/var/run/docker.sock:ro
    - traefik-certs:/letsencrypt
  networks:
    - faildaily-ssl-network
  labels:
    # Middleware de sécurité (identique OVH)
    - "traefik.enable=true"
    - "traefik.http.middlewares.security-headers.headers.sslredirect=true"
    - "traefik.http.middlewares.security-headers.headers.stsSeconds=31536000"
    - "traefik.http.middlewares.security-headers.headers.stsIncludeSubdomains=true"
    - "traefik.http.middlewares.security-headers.headers.stsPreload=true"
    - "traefik.http.middlewares.security-headers.headers.forceSTSHeader=true"
