services:
  portainer:
    image: portainer/portainer-ce:latest
    container_name: portainer
    restart: unless-stopped
    ports:
      - "9001:9000"                # keep for now (fallback)
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
      - /home/rezayaghobi/docker/portainer/data:/data
    networks:
      - web_net
    labels:
      - "traefik.enable=true"
      - "traefik.docker.network=web_net"

      # HTTPS
      - "traefik.http.routers.portainer.rule=Host(`portainer.home.server`)"
      - "traefik.http.routers.portainer.entrypoints=websecure"
      - "traefik.http.routers.portainer.tls=true"
      - "traefik.http.routers.portainer.service=portainer"
      - "traefik.http.routers.portainer.middlewares=security-headers@file"

      # HTTP → HTTPS redirect
      - "traefik.http.routers.portainer-http.rule=Host(`portainer.home.server`)"
      - "traefik.http.routers.portainer-http.entrypoints=web"
      - "traefik.http.routers.portainer-http.middlewares=redirect-to-https@file"

      # Internal port (Portainer listens on 9000 inside the container)
      - "traefik.http.services.portainer.loadbalancer.server.port=9000"

networks:
  web_net:
    external: true