http:

  ## EXTERNAL ROUTING - Only use if you want to proxy something manually ##
  routers:
    # Homeassistant routing - Remove if not used
    homeassistant:
      entryPoints:
        - https
      rule: 'Host(`homeassistant.ramuska.com`)'
      service: homeassistant
      middlewares:
        - auth
  ## SERVICES ##
  services:
    # Homeassistant service - Remove if not used
    homeassistant:
      loadBalancer:
        servers:
          - url: http://192.168.1.2:8123
  ## MIDDLEWARES ##
  middlewares:
    https-redirect:
      redirectScheme:
        scheme: https
        permanent: true

    crowdsec-bouncer:
      forwardauth:
        address: http://crowdsec-traefik-bouncer:8080/api/v1/forwardAuth
        trustForwardHeader: true

    # Only Allow Local networks
    local-ipwhitelist:
      ipWhiteList:
        sourceRange:
          - 127.0.0.1/32 # localhost
          - 192.168.1.1/24 # LAN Subnet

    # Authelia guard
    auth:
      forwardauth:
        address: http://authelia:9091/api/verify?rd=https://authelia.ramuska.com/ # replace auth with your authelia container name
        trustForwardHeader: true
        authResponseHeaders:
          - Remote-User
          - Remote-Groups
          - Remote-Name
          - Remote-Email

    # Authelia basic auth guard
    auth-basic:
      forwardauth:
        address: http://authelia:9091/api/verify?auth=basic # replace auth with your authelia container name
        trustForwardHeader: true
        authResponseHeaders:
          - Remote-User
          - Remote-Groups
          - Remote-Name
          - Remote-Email

    # Security headers
    securityHeaders:
      headers:
        customResponseHeaders:
          X-Robots-Tag: "none,noarchive,nosnippet,notranslate,noimageindex"
          X-Forwarded-Proto: "https"
          server: ""
        customRequestHeaders:
          X-Forwarded-Proto: "https"
        sslProxyHeaders:
          X-Forwarded-Proto: "https"
        referrerPolicy: "same-origin"
        hostsProxyHeaders:
          - "X-Forwarded-Host"
        contentTypeNosniff: true
        browserXssFilter: true
        forceSTSHeader: true
        stsIncludeSubdomains: true
        stsSeconds: 63072000
        stsPreload: true
    ### Let's give them a new name so it won't conflict with others
    nextcloud-middlewares-secure-headers:
      headers:
        hostsProxyHeaders:
          - "X-Forwarded-Host"
        accessControlMaxAge: 100
        stsSeconds: 63072000
        stsIncludeSubdomains: true
        stsPreload: true
        forceSTSHeader: true
    ### We will modify this value for Nextcloud to remove the X-Frame-Options error:
        customFrameOptionsValue: "SAMEORIGIN" #CSP takes care of this but may be needed for organizr.
        contentTypeNosniff: true
        browserXssFilter: true
#       sslForceHost: true # add sslHost to all of the services
#       sslHost: "example.com"
        referrerPolicy: "same-origin"
        customResponseHeaders:
    ### Change this to none to remove the Robots error:
          X-Robots-Tag: "noindex,nofollow"

### This section redirects requests for Nextcloud calendar and contacts service discovery
### source: https://docs.nextcloud.com/server/21/admin_manual/issues/general_troubleshooting.html#service-discovery
    nextcloud-redirect:
      redirectRegex:
        permanent: true
        regex: "https://(.*)/.well-known/(card|cal)dav"
        replacement: "https://${1}/remote.php/dav/"

    chain-nextcloud:
      chain:
        middlewares:
          - nextcloud-middlewares-secure-headers
          - nextcloud-redirect
# Only use secure ciphers - https://ssl-config.mozilla.org/#server=traefik&version=2.6.0&config=intermediate&guideline=5.6
tls:
  options:
    default:
      minVersion: VersionTLS12
      cipherSuites:
        - TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
        - TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
        - TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
        - TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
        - TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305
        - TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305