docker-compose.proxy-services.yml

version: "3.7"
services:
  fail2ban:
    container_name: fail2ban
    image: crazymax/fail2ban:latest
    restart: always
    network_mode: "host"
    depends_on:
      - "pihole"
    cap_add:
      - NET_ADMIN
      - NET_RAW
    volumes:
      #this needs to read the traefik log
      - ${USERDIR}/traefik/log:/var/log:ro
      - ${USERDIR}/fail2ban/data:/data
  traefik:
    hostname: traefik
    image: traefik:maroilles
    container_name: traefik
    restart: always
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
      # create these toml files first
      - ${USERDIR}/traefik/traefik.toml:/etc/traefik/traefik.toml:ro
      - ${USERDIR}/traefik/rules.toml:/etc/traefik/rules.toml:ro
      - ${USERDIR}/traefik/acme:/etc/traefik/acme
      - ${USERDIR}/shared:/shared
      - ${USERDIR}/traefik/log:/var/log
    ports:
      - "80:80"
      - "443:443"
      #- "8090:8080"
    networks:
      - default
      - traefik_proxy
    environment:
      - CLOUDFLARE_EMAIL=${CLOUDFLARE_EMAIL}
      - CLOUDFLARE_API_KEY=${CLOUDFLARE_API_KEY}
    command:
      - --web
      - --accessLog.filePath=/var/log/access.log
      - --accessLog.filters.statusCodes=400-499
    labels:
      - "traefik.enable=true"
      - "traefik.backend=traefik"
      - "traefik.frontend.rule=Host:traefik.${DOMAINNAME}"
      - "traefik.frontend.auth.basic: ${HTTP_USERNAME}:${HTTP_PASSWORD}"
      - "traefik.port=8080"
      - "traefik.docker.network=traefik_proxy"
      - "traefik.frontend.headers.SSLRedirect=true"
      - "traefik.frontend.headers.STSSeconds=315360000"
      - "traefik.frontend.headers.browserXSSFilter=true"
      - "traefik.frontend.headers.contentTypeNosniff=true"
      - "traefik.frontend.headers.forceSTSHeader=true"
      - "traefik.frontend.headers.SSLHost=${DOMAINNAME}.com"
      - "traefik.frontend.headers.STSIncludeSubdomains=true"
      - "traefik.frontend.headers.STSPreload=true"
      - "traefik.frontend.headers.frameDeny=true"
      - "traefik.frontend.headers.contentSecurityPolicy=upgrade-insecure-requests"
      - "traefik.frontend.headers.customResponseHeaders=X-Robots-Tag:noindex,nofollow,nosnippet,noarchive,notranslate,noimageindex"