services:
  traefik:
    image: traefik:v3.7.5
    container_name: tcp-loadbalancer-traefik
    restart: unless-stopped
    command:
      - --configFile=/etc/traefik/traefik.yml
    network_mode: host
    volumes:
      - ./config:/etc/traefik:ro
    read_only: true
    cap_drop:
      - ALL
    cap_add:
      - NET_BIND_SERVICE
    security_opt:
      - no-new-privileges:true
    healthcheck:
      test: ["CMD", "traefik", "healthcheck", "--ping"]
      interval: 30s
      timeout: 5s
      retries: 3
      start_period: 10s