version: '3.4'
services:
  registry:
    image: registry:2
    volumes:
      - registry-data:/registry
    deploy:
      placement:
        constraints:
          - node.role == manager
      labels:
        - traefik.enable=true
        - traefik.docker.network=traefik-public
        - traefik.constraint-label=traefik-public
        - traefik.http.middlewares.docker-registry-auth.basicauth.users=${REGISTRY_USERNAME?Variable not set}:${REGISTRY_HASHED_PASSWORD?Variable not set}
        - traefik.http.routers.docker-registry-http.rule=Host(`${REGISTRY_HOST?Variable not set}`)
        - traefik.http.routers.docker-registry-http.entrypoints=http
        - traefik.http.routers.docker-registry-http.middlewares=https-redirect
        - traefik.http.routers.docker-registry-https.rule=Host(`${REGISTRY_HOST?Variable not set}`)
        - traefik.http.routers.docker-registry-https.entrypoints=https
        - traefik.http.routers.docker-registry-https.tls=true
        - traefik.http.routers.docker-registry-https.tls.certresolver=le
        - traefik.http.routers.docker-public-https.middlewares=docker-registry-auth
        - traefik.http.services.docker-registry.loadbalancer.server.port=5000
    networks:
      - traefik-public
volumes:
  registry-data:
    driver: local
networks:
  traefik-public:
    external: true