version: '3'

services:
  portainer:
    image: portainer/portainer-ce:latest
    container_name: portainer
    networks:
      - traefik
    restart: unless-stopped
    security_opt:
      - no-new-privileges:true
    volumes:
      - /etc/localtime:/etc/localtime:ro
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - /srv/portainer/portainer-data:/data
    ports:
      - 9000:9000
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.portainer.entrypoints=websecure"
      - "traefik.http.routers.portainer.rule=Host(`portainer.$DOMAIN_NAME`)"
      - "traefik.http.routers.portainer.tls.certresolver=letsencr"
      - "traefik.http.services.portainer.loadbalancer.server.port=9000"
      - "traefik.http.routers.portainer.middlewares=portainer_auth"
      - "traefik.http.middlewares.portainer_auth.basicauth.users=admin:$$2a$$12$$MkhjqyuriyoE5.Mhz14ZXOkfjE7wUEDb46e9argix38VHZ5aAuGQC"

networks:
  traefik:
    external: true