services:
  traefik:
    image: traefik:v3
    container_name: traefik
    restart: always
    # Traefik replaces nginx-proxy-manager on 80/443. Decommission NPM before
    # deploying this (both can't bind 80/443). UDP/443 (SMB-over-QUIC) is NOT
    # handled here — the router forwards UDP/443 straight to serverfile.
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - ./traefik.yml:/etc/traefik/traefik.yml:ro,z
      - ./dynamic:/etc/traefik/dynamic:ro,z
      - /mnt/containers/traefik/container-data/acme:/acme:z
    networks:
      - reverseproxy-nw

networks:
  reverseproxy-nw:
    external: true