labels:
  - "traefik.enable=true"
  # ... other labels ...

  # Dashboard router
  - "traefik.http.routers.traefik-secure.entrypoints=websecure"
  - "traefik.http.routers.traefik-secure.rule=Host(`dash.${DOMAIN}`)"
  - "traefik.http.routers.traefik-secure.tls=true"
  - "traefik.http.routers.traefik-secure.tls.certresolver=cloudflare"

  # Main domain wildcard
  - "traefik.http.routers.traefik-secure.tls.domains[0].main=${DOMAIN}"
  - "traefik.http.routers.traefik-secure.tls.domains[0].sans=*.${DOMAIN}"

  # sub1.domain.com wildcard
  - "traefik.http.routers.traefik-secure.tls.domains[1].main=sub1.${DOMAIN}"
  - "traefik.http.routers.traefik-secure.tls.domains[1].sans=*.sub1.${DOMAIN}"

  # sub2.domain.com wildcard
  - "traefik.http.routers.traefik-secure.tls.domains[2].main=sub2.${DOMAIN}"
  - "traefik.http.routers.traefik-secure.tls.domains[2].sans=*.sub2.${DOMAIN}"

  - "traefik.http.routers.traefik-secure.service=api@internal"