services:
  traefik:
    image: traefik:3.6 # Gepinnt auf Version 3.6
    container_name: traefik
    restart: unless-stopped
    security_opt:
      - no-new-privileges:true
    command:
      - "--configFile=/etc/traefik/traefik.yml"
      - "--log.level=INFO"
    environment:
      - DOCKER_API_VERSION=1.47
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - /mnt/traefik:/etc/traefik
    networks:
      - traefik-net
    labels:
      - "traefik.enable=true"
      # Dashboard Router - Korrigierte Syntax für Host-Regel
      - "traefik.http.routers.dashboard.rule=Host(`traefik.ljh31.de`)"
      - "traefik.http.routers.dashboard.entrypoints=websecure"
      - "traefik.http.routers.dashboard.tls=true"
      - "traefik.http.routers.dashboard.tls.certresolver=letsencrypt"
      - "traefik.http.routers.dashboard.service=api@internal"
      
      # Middleware Auswahl: Aktuell ist Basic Auth aktiv
      - "traefik.http.routers.dashboard.middlewares=dashboard-auth"
      
      # Basic Auth Definition
      - "traefik.http.middlewares.dashboard-auth.basicauth.users=admin:$$apr1$$xyz$$..."
      
      # Keycloak ForwardAuth Middleware (bereitgestellt, aber aktuell nicht im Router zugewiesen)
      - "traefik.http.middlewares.keycloak-oauth2.forwardauth.address=http://<OAUTH2_PROXY_URL>/oauth2/auth"
      - "traefik.http.middlewares.keycloak-oauth2.forwardauth.trustForwardHeader=true"
      - "traefik.http.middlewares.keycloak-oauth2.forwardauth.authResponseHeaders=X-Auth-Request-User,X-Auth-Request-Email"
    healthcheck:
      test: ["CMD", "traefik", "healthcheck"]
      interval: 10s
      timeout: 5s
      retries: 3

networks:
  traefik-net:
    driver: bridge