dynamic/core.yaml

http:

#----------------------: https://doc.traefik.io/traefik/routing/routers/
  routers:

    # harden dashboard access: can only be accessed with a username/password
    dashboard:
      rule: "Host(`traefik-proxy.mydomain.com`) && (PathPrefix(`/api`) || PathPrefix(`/dashboard`))"
      service: api@internal
      middlewares:
        - auth

    # catchall rule, evaluated when no router exists for a request;
    # applicable to HTTP and HTTPS entryPoints only
    catchall:
      entryPoints:
        - "http"
        - "https"
      rule: "PathPrefix(`/`)"
      service: unavailable
      priority: 1

#----------------------: https://doc.traefik.io/traefik/routing/services/
  services:

    # Service that will always provide a 503 Service Unavailable response
    unavailable:
      loadBalancer:
        servers: {}

#----------------------: https://doc.traefik.io/traefik/middlewares/http/overview/
  middlewares:

    auth:
      basicAuth:
        users:    # users and MD5 hashed passwords, granted access to the traefik-proxy dashboard
          - "user:$1$qkpRj/qY$FRb0wAZO8saHdPr4M4oE90"

    internal-hosts-endorsed:
      ipAllowList:
        sourceRange:
          - "192.168.2.0/24"

    http-only:
      redirectScheme:
        scheme: http
        permanent: true

    internal-http-hosts:
      chain:
        middlewares:
          - internal-hosts-endorsed
          - http-only

    https-only:
      redirectScheme:
        scheme: https
        permanent: true

    # chains are useful when multiple middleware needs to be applied to a route,
    # especially if the chain has to be applied to multiple routes
    internal-https-hosts:
      chain:
        middlewares:
          - internal-hosts-endorsed
          - https-only

#----------------------: https://doc.traefik.io/traefik/https/tls/
tls:
  options:
    default:
      minVersion: VersionTLS13    # change to a lower version if you expect to service Internet traffic from around the world
      curvePreferences:    # below is ordered list
        - X25519       # the most commonly used 128-bit
        - CurveP256    # the next most commonly used 128-bit
        - CurveP384    # 192-bit
        - CurveP521    # 256-bit
      sniStrict: true    # true if our own certificates should be enforced

#### Traefik uses its own default certificate for connections without SNI, or without a matching domain.
#  certificates:
#    - certFile: /etc/traefik/domain.cert
#      keyFile: /etc/traefik/domain.key
#    - certFile: /etc/traefik/certificate.pem
#      keyFile: /etc/traefik/private_key.pem

#### However, we can provide our own default certificate, instead of using the Traefik default.
#  stores:
#    default:
#      defaultCertificate:
#        certFile: /etc/traefik/cert.crt
#        keyFile: /etc/traefik/cert.key

#### Alternatively, we can use an ACME generated default certificate.
  stores:
    default:
      defaultGeneratedCert:
        resolver: cloudflare
        domain:
          main: mydomain.com
          sans:
            - "*.mydomain.com"