services:
  agent:
    image: portainer/agent:sts
    environment:
      AGENT_CLUSTER_ADDR: tasks.agent
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:z
      - /var/lib/docker/volumes:/var/lib/docker/volumes
    networks:
      - agent-network
    deploy:
      mode: global
      placement:
        constraints:
          - node.platform.os == linux

  portainer:
    image: portainer/portainer-ce:sts
    command: -H tcp://tasks.agent:9001 --tlsskipverify
    volumes:
      - portainer-data:/data
    networks:
      - agent-network
      - traefik-public
    deploy:
      placement:
        constraints:
          - node.role == manager
          - node.labels.portainer.portainer-data == true
      labels:
        - traefik.enable=true
        - traefik.swarm.network=traefik-public
        - traefik.constraint-label=traefik-public
        - traefik.http.routers.portainer-https.entrypoints=https
        - traefik.http.routers.portainer-https.rule=Host(`port.${DOMAIN?Variable not set}`) || Host(`portainer.${DOMAIN?Variable not set}`)
        - traefik.http.routers.portainer-https.tls.certresolver=le
        - traefik.http.routers.portainer-https.service=portainer_service
        - traefik.http.routers.portainer-local-https.entrypoints=https
        - traefik.http.routers.portainer-local-https.rule=Host(`port.${LOCALDOMAIN?Variable not set}`) || Host(`portainer.${LOCALDOMAIN?Variable not set}`)
        - traefik.http.routers.portainer-local-https.tls=true
        - traefik.http.routers.portainer-local-https.service=portainer_service
        - traefik.http.services.portainer_service.loadbalancer.server.port=9000

networks:
  agent-network:
    driver: overlay
    attachable: true
  traefik-public:
    external: true

volumes:
  portainer-data: