services:
  traefik:
    image: traefik:v3.7.10
    container_name: traefik
    restart: unless-stopped
    env_file: ../.env
    command:
      - --api.insecure=true
      - --providers.docker=true
      - --providers.file.directory=/dynamic
      - --providers.file.watch=true
      - --entrypoints.web.address=:80
      - --entrypoints.websecure.address=:443
      - --api.dashboard=true
      - --log.level=INFO
      # --- 下面是新增的 Let's Encrypt DNS-01 配置 ---
      # 定义一个名为 "cfresolver" 的证书解析器
      - --certificatesresolvers.cfresolver.acme.dnschallenge=true
      - --certificatesresolvers.cfresolver.acme.dnschallenge.provider=cloudflare
      # 填入你的真实邮箱，用于接收证书快过期的通知
      - --certificatesresolvers.cfresolver.acme.email=LiuXiteng72@gmail.com
      # 证书保存路径（对应上面 volumes 里的挂载）
      - --certificatesresolvers.cfresolver.acme.storage=/letsencrypt/acme.json
    ports:
      - "80:80"
      - "443:443"
      - "8080:8080"
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - ./letsencrypt:/letsencrypt
      - ../edge-cache/dynamic:/dynamic:ro
    labels:
      - "xiteng.site.component.traefik.enabled=true"
      - "xiteng.site.component.traefik.name=Traefik"
      - "xiteng.site.component.traefik.description=动态反向代理、TLS 终止与服务路由中心。"
      - "xiteng.site.component.traefik.section=infrastructure"
      - "xiteng.site.component.traefik.category=边缘与网络"
      - "xiteng.site.component.traefik.endpoint=HTTP :80 · HTTPS :443"
      - "xiteng.site.component.traefik.access=internal"
      - "xiteng.site.component.traefik.access-label=管理面仅内网"
      - "xiteng.site.component.traefik.icon=TR"
      - "xiteng.site.component.traefik.icon-url=https://cdn.jsdelivr.net/gh/homarr-labs/dashboard-icons/svg/traefik.svg"
      - "xiteng.site.component.traefik.accent=red"
      - "xiteng.site.component.traefik.order=110"
    networks:
      - homelab_net

networks:
  homelab_net:
    external: true