services:
  traefik:
    image: traefik:v3.7.5
    container_name: tcp-loadbalancer-traefik
    restart: unless-stopped
    command:
      - --configFile=/etc/traefik/traefik.yml
    ports:
      - "80:8080/tcp"
      - "443:8443/tcp"
    extra_hosts:
      - "host.docker.internal:host-gateway"
    volumes:
      - ./config:/etc/traefik:ro
    read_only: true
    cap_drop:
      - ALL
    security_opt:
      - no-new-privileges:true
    healthcheck:
      test: ["CMD", "traefik", "healthcheck", "--ping"]
      interval: 30s
      timeout: 5s
      retries: 3
      start_period: 10s