services:
  traefik:
    image: traefik:v3
    container_name: traefik
    restart: always
    # Traefik replaces nginx-proxy-manager on 80/443. Decommission NPM before
    # deploying this (both can't bind 80/443). UDP/443 (SMB-over-QUIC) is NOT
    # handled here — the router forwards UDP/443 straight to serverfile.
    #
    # NOTE: absolute host paths (NOT ./relative). Portainer GitOps runs compose
    # with paths relative to its own container (/data/compose/<id>/...), which
    # the Docker daemon can't resolve — relative mounts silently become empty
    # dirs. Config files live on the host; keep them in sync with this repo's
    # traefik.yml / dynamic/ (source of truth).
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - /mnt/containers/traefik/container-data/traefik.yml:/etc/traefik/traefik.yml:ro,z
      - /mnt/containers/traefik/container-data/dynamic:/etc/traefik/dynamic:ro,z
      - /mnt/containers/traefik/container-data/acme:/acme:z
    networks:
      - reverseproxy-nw

networks:
  reverseproxy-nw:
    external: true