http:
  routers:
    # Nextcloud proxy (directly from Traefik to external server)
    cloud:
      rule: Host(`cloud.truckwash.dk`)
      entryPoints: [websecure]
      service: cloud-svc
      tls:
        certResolver: le
    cloud-http:
      rule: Host(`cloud.truckwash.dk`)
      entryPoints: [web]
      middlewares: [redirect-to-https]
      service: cloud-svc

    # Dashboard routers are declared via labels; middlewares are defined below.

  middlewares:
    redirect-to-https:
      redirectScheme:
        scheme: https
    dashboard-auth:
      basicAuth:
        # IMPORTANT: Replace REPLACE_WITH_BCRYPT_HASH with a bcrypt/htpasswd hash for user 'truckwash'.
        # Example command to generate (once Docker is available):
        #   docker run --rm httpd:2.4-alpine htpasswd -nbB truckwash 'w5j9MlEVz62Exm6r'
        users:
          - "truckwash:$2y$05$DYcMFqMPgEFWAJQioc.F3.v9ppi9bReAi/aQzoOlWqMyhIysKlDCC"
    dashboard-allow-local:
      ipWhiteList:
        sourceRange:
          - 127.0.0.1/32
          - 10.0.0.0/8
          - 172.16.0.0/12
          - 192.168.0.0/16
    secure-headers:
      headers:
        sslRedirect: true
        stsSeconds: 31536000
        stsIncludeSubdomains: true
        stsPreload: false
        contentTypeNosniff: true
        browserXssFilter: true
        referrerPolicy: "strict-origin-when-cross-origin"
        customFrameOptionsValue: "SAMEORIGIN"
        permissionsPolicy: "geolocation=(), microphone=(), camera=(), payment=()"
        addVaryHeader: true
        # CORS: allow all origins (with credentials). Attach this middleware where needed.
        accessControlAllowOriginList:
          - "https://truckwash.io"
        accessControlAllowMethods:
          - GET
          - POST
          - PUT
          - PATCH
          - DELETE
          - OPTIONS
        accessControlAllowHeaders:
          - "*"
        accessControlAllowCredentials: true
        accessControlMaxAge: 86400
    api-ratelimit:
      rateLimit:
        average: 100
        burst: 200

  services:
    cloud-svc:
      loadBalancer:
        servers:
          - url: "http://94.130.142.41:11000"

tls:
  options:
    default:
      minVersion: VersionTLS12
      sniStrict: true
      cipherSuites:
        - TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
        - TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
        - TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
        - TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
        - TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305
        - TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305