# Traefik v3 — single edge reverse proxy for 43-meditsina (replaces nginx-proxy-manager).
#
#   • SNI pass-through (L4) for Exchange → native NTLM/Kerberos survives → desktop Outlook
#     can be set up from outside the office (the reason for this migration)
#   • TLS-terminate + Let's Encrypt autorenew (L7) for the remaining web services
#   • Forwards the ACME challenge path for the Exchange names to Exchange itself, so its
#     win-acme renewal stops needing a manual port-80 NAT repoint (see README)
#
# Deployed via Portainer GitOps. IMPORTANT: Portainer pulls ONLY this docker-compose.yaml.
# The config files must be staged on the HOST at absolute paths beforehand — Portainer runs
# compose relative to its own container, so relative ./mounts resolve to empty dirs and
# Traefik crash-loops. See README.md → "One-time host preparation".
#
# Host: docker (43) — 192.168.0.9, tunnel port 43009. SELinux is Enforcing, hence `:Z`.

services:
  traefik:
    image: traefik:v3.3
    container_name: traefik
    restart: unless-stopped
    ports:
      - "80:80"
      - "443:443"
    environment:
      - TZ=${TZ:-Europe/Moscow}
    volumes:
      - /mnt/containers/traefik/container-data/traefik.yml:/etc/traefik/traefik.yml:ro,Z
      - /mnt/containers/traefik/container-data/dynamic:/etc/traefik/dynamic:ro,Z
      - /mnt/containers/traefik/container-data/users:/etc/traefik/users:ro,Z
      - /mnt/containers/traefik/container-data/acme:/etc/traefik/acme:Z
      - /mnt/containers/traefik/container-data/logs:/var/log/traefik:Z
    networks:
      - reverseproxy-nw

networks:
  reverseproxy-nw:
    external: true