# Production-style override: put the gateway (frontend + API) behind Traefik
# with automatic Let's Encrypt TLS. Use together with the base file:
#
#   docker compose -f docker-compose.yml -f docker-compose.traefik.yml up -d --build
#
# Only Traefik publishes host ports (80/443). Everything else is reachable
# only on the compose network.

services:
  traefik:
    image: traefik:v3.6
    restart: unless-stopped
    command:
      - --providers.docker=true
      - --providers.docker.exposedByDefault=false
      - --entrypoints.web.address=:80
      - --entrypoints.web.http.redirections.entryPoint.to=websecure
      - --entrypoints.web.http.redirections.entryPoint.scheme=https
      - --entrypoints.websecure.address=:443
      - --certificatesresolvers.le.acme.httpchallenge=true
      - --certificatesresolvers.le.acme.httpchallenge.entrypoint=web
      - --certificatesresolvers.le.acme.storage=/letsencrypt/acme.json
      - --log.level=INFO
      - --accesslog=true
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - letsencrypt:/letsencrypt

  gateway:
    ports: !reset []
    labels:
      - traefik.enable=true
      - traefik.http.routers.ledgerline.rule=Host(`ledgerline.vione.cloud`)
      - traefik.http.routers.ledgerline.entrypoints=websecure
      - traefik.http.routers.ledgerline.tls.certresolver=le
      - traefik.http.services.ledgerline.loadbalancer.server.port=8000

  postgres:
    ports: !reset []

  redis:
    ports: !reset []

  ledger:
    ports: !reset []

  fraud:
    ports: !reset []

  sanctions:
    ports: !reset []

  insights:
    ports: !reset []

  notifier:
    ports: !reset []

volumes:
  letsencrypt: