docker-stack.yml

services:
  loadbalancer:
    configs:
    - source: haproxy.cfg
      target: /usr/local/etc/haproxy/haproxy.cfg
    deploy:
      mode: global
      labels:
        io.prometheus.enabled: "true"
        io.prometheus.job_name: haproxy
        io.prometheus.scrape_port: "8405"
      update_config:
        parallelism: 1
        delay: 10s
        failure_action: rollback
        monitor: 1m0s
        max_failure_ratio: 0.3
      rollback_config:
        parallelism: 1
        failure_action: continue
      restart_policy:
        condition: any
        delay: 5s
        max_attempts: 3
        window: 2m0s
    hostname: replica-{{.Task.Slot}}.haproxy.internal
    healthcheck:
      test:
      - CMD
      - haproxy
      - -c
      - -f
      - /usr/local/etc/haproxy/haproxy.cfg
      timeout: 2s
      interval: 5s
      retries: 3
      start_period: 10s
    image: haproxy:3.0
    networks:
      prometheus: null
      traefik: null
    ports:
    - mode: host
      target: 80
      published: 80
      protocol: tcp
    - mode: host
      target: 443
      published: 443
      protocol: tcp
    - mode: host
      target: 443
      published: 443
      protocol: udp
    - mode: host
      target: 8080
      published: 8080
      protocol: tcp
    - mode: host
      target: 8404
      published: 8404
      protocol: tcp
    user: "0:0"
  traefik:
    command:
    - --ping=true
    - --accesslog=${TRAEFIK_ACCESSLOG:-false}
    - --api.dashboard=${TRAEFIK_API_DASHBOARD:-false}
    - --api.insecure=${TRAEFIK_API_INSECURE:-false}
    - --certificatesresolvers.letsencrypt.acme.caserver=https://acme-v02.api.letsencrypt.org/directory
    - --certificatesresolvers.letsencrypt.acme.httpchallenge.entrypoint=http
    - --certificatesresolvers.letsencrypt.acme.storage=/letsencrypt/letsencrypt.json
    - --certificatesresolvers.letsencrypt-staging.acme.caserver=https://acme-staging-v02.api.letsencrypt.org/directory
    - --certificatesresolvers.letsencrypt-staging.acme.httpchallenge.entrypoint=http
    - --certificatesresolvers.letsencrypt-staging.acme.storage=/letsencrypt/letsencrypt-staging.json
    - --entryPoints.http.address=:80
    - --entryPoints.http.proxyProtocol.insecure=true
    - --entryPoints.http.forwardedHeaders.insecure=true
    - --entryPoints.https.address=:443
    - --entryPoints.https.proxyProtocol.insecure=true
    - --entryPoints.https.forwardedHeaders.insecure=true
    - --global.checknewversion=false
    - --global.sendanonymoususage=false
    - --log.level=${TRAEFIK_LOGLEVEL:-INFO}
    - --metrics.prometheus=true
    - --providers.swarm.allowEmptyServices=true
    - --providers.swarm.endpoint=unix:///var/run/docker.sock
    - --providers.swarm.exposedByDefault=false
    - --providers.swarm.network=public
    - --providers.swarm.refreshSeconds=30
    deploy:
      replicas: 1
      labels:
        io.prometheus.enabled: "true"
        io.prometheus.job_name: traefik
        io.prometheus.scrape_port: "8080"
      update_config:
        parallelism: 1
        delay: 10s
        failure_action: rollback
        monitor: 1m0s
        max_failure_ratio: 0.3
        order: start-first
      rollback_config:
        parallelism: 1
        failure_action: continue
        order: start-first
      restart_policy:
        condition: any
        delay: 5s
        max_attempts: 3
        window: 2m0s
      placement:
        constraints:
        - node.role == manager
    hostname: replica-{{.Task.Slot}}.traefik.internal
    healthcheck:
      test:
      - CMD
      - traefik
      - healthcheck
      - --ping
      timeout: 2s
      interval: 5s
      retries: 3
      start_period: 10s
    image: traefik:3.0
    networks:
      prometheus: null
      public: null
      traefik:
        aliases:
        - traefik.internal
    volumes:
    - type: bind
      source: /var/run/docker.sock
      target: /var/run/docker.sock
      read_only: true
    - type: volume
      source: letsencrypt
      target: /letsencrypt
networks:
  prometheus:
    name: prometheus
    external: true
  public:
    name: public
    external: true
  traefik: {}
volumes:
  letsencrypt: {}
configs:
  haproxy.cfg:
    name: traefik-ingress-loadbalancer-config-v1
    file: ./loadbalancer/configs/haproxy.cfg