http:

  ## EXTERNAL ROUTING EXAMPLE - Only use if you want to proxy something manually ##
  routers:
    firefly:
      entryPoints:
        - websecure
        - web
      rule: 'Host(`firefly.dreamwoodestate.net`)'
      service: firefly
      middlewares:
        - "local-ipwhitelist@file"

    homeassistant:
      entryPoints:
        - websecure
        - web
      rule: 'Host(`ha.dreamwoodestate.net`)'
      service: homeassistant
      middlewares:
        - "local-ipwhitelist@file"

    homebox:
      entryPoints:
        - websecure
        - web
      rule: 'Host(`homebox.dreamwoodestate.net`)'
      service: homebox
      middlewares:
        - "local-ipwhitelist@file"

    immich:
      entryPoints:
        - websecure
        - web
      rule: 'Host(`immich.dreamwoodestate.net`)'
      service: immich
      middlewares:
        - "local-ipwhitelist@file"

    mealie:
      entryPoints:
        - websecure
        - web
      rule: 'Host(`mealie.dreamwoodestate.net`)'
      service: mealie
      middlewares:
        - "local-ipwhitelist@file"

    mqtt-router:
      entryPoints:
        - mqtt-ws
      rule: "Host(`mqtt.dreamwoodestate.net`)"
      service: mqtt-ws-svc
      tls: true

    mqtt_ws:
      rule: "Host(`mqtt.dreamwoodestate.net`)"
      entryPoints:
        - mqtt-ws
      tls:
        certResolver: cloudflare
      service: mqtt_ws_service  

    netbox:
      entryPoints:
        - websecure
        - web
      rule: 'Host(`netbox.dreamwoodestate.net`)'
      service: netbox
      middlewares:
        - "local-ipwhitelist@file"

    nextcloud:
      entryPoints:
        - websecure
        - web
      rule: 'Host(`nextcloud.dreamwoodestate.net`)'
      service: nextcloud
      middlewares:
        - "local-ipwhitelist@file"

    pbs:
      entryPoints:
        - websecure
        - web
      rule: 'Host(`pbs.dreamwoodestate.net`)'
      service: pbs
      middlewares:
        - "local-ipwhitelist@file"

    portainer:
      entryPoints:
        - websecure
        - web
      rule: "Host(`portainer.dreamwoodestate.net`)"
      service: portainer
      middlewares:
        - "local-ipwhitelist@file"

    prox1:
      entryPoints:
        - websecure
        - web
      rule: "Host(`prox1.dreamwoodestate.net`)"
      service: prox1
      middlewares:
        - "local-ipwhitelist@file"

    prox2:
      entryPoints:
        - websecure
        - web
      rule: "Host(`prox2.dreamwoodestate.net`)"
      service: prox2
      middlewares:
        - "local-ipwhitelist@file"

    truenas:
      entryPoints:
        - websecure
        - web
      rule: "Host(`truenas.dreamwoodestate.net`)"
      service: truenas
      middlewares:
        - "local-ipwhitelist@file"

    vaultwarden:
      entryPoints:
        - websecure
        - web
      rule: "Host(`vaultwarden.dreamwoodestate.net`)"
      service: vaultwarden
      middlewares:
        - "local-ipwhitelist@file"

    wireguard:
      entryPoints:
        - websecure
        - web
      rule: "Host(`wireguard.dreamwoodestate.net`)"
      service: wireguard
      middlewares:
        - "local-ipwhitelist@file"

  ## SERVICES EXAMPLE ##
  services:
    firefly:
      loadBalancer:
        serversTransport: insecureTransport
        servers:
          - url: http://192.168.88.61:8080

    homeassistant:
      loadBalancer:
        serversTransport: insecureTransport
        servers:
          - url: http://192.168.88.62:8123

    homebox:
      loadBalancer:
        serversTransport: insecureTransport
        servers:
          - url: http://192.168.88.61:3100

    immich:
      loadBalancer:
        serversTransport: insecureTransport
        servers:
          - url: http://192.168.88.66:2283

    mealie:
      loadBalancer:
        serversTransport: insecureTransport
        servers:
          - url: http://192.168.88.61:9925

    mqtt-broker:
      loadBalancer:
        servers:
          - url: "http://192.168.88.67:9011"

    mqtt-ws-svc:
      loadBalancer:
        servers:
          - url: "http://192.168.88.67:9011"

    netbox:
      loadBalancer:
        serversTransport: insecureTransport
        servers:
          - url: https://192.168.88.63

    nextcloud:
      loadBalancer:
        serversTransport: insecureTransport
        servers:
          - url: http://192.168.88.61:8082

    pbs:
      loadBalancer:
        serversTransport: insecureTransport
        servers:
          - url: https://192.168.88.107:8007

    portainer:
      loadBalancer:
        serversTransport: insecureTransport
        servers:
          - url: https://192.168.88.64:9443

    prox1:
      loadBalancer:
        serversTransport: insecureTransport
        servers:
          - url: https://192.168.88.101:8006

    prox2:
      loadBalancer:
        serversTransport: insecureTransport
        servers:
          - url: https://192.168.88.103:8006

    truenas:
      loadBalancer:
        serversTransport: insecureTransport
        servers:
          - url: https://192.168.88.102

    vaultwarden:
      loadBalancer:
        serversTransport: insecureTransport
        servers:
          - url: http://192.168.88.61:80

    wireguard:
      loadBalancer:
        serversTransport: insecureTransport
        servers:
          - url: http://192.168.88.61:51821

# Allow self-signed certificates for proxied web services
  serversTransports:
    insecureTransport:
      insecureSkipVerify: true

  ## MIDDLEWARES ##
  middlewares:
    # From ChatGPT
    mqtt-strip:
      stripPrefix:
        prefixes:
          - "/mqtt"

    # basic auth popup
    basic-auth:
      basicAuth:
      # https://hostingcanada.org/htpasswd-generator/
        users:
          - "redacted" # admin:password

    # Only Allow Local networks
    local-ipwhitelist:
      ipAllowList:
        sourceRange:
          - 127.0.0.1/32 # localhost
          - 10.0.0.0/8 # private class A
          - 172.16.0.0/12 # private class B
          - 192.168.0.0/16 # private class C
        #ipstrategy: # enable this when cloudflare proxy in use
        #  depth: 1 # enable this when cloudflare proxy in use

    # Security headers
    security-headers:
      headers:
        customResponseHeaders: # field names are case-insensitive
          #X-Robots-Tag: "all,noarchive,nosnippet,notranslate,noimageindex"
          Server: "" # prevent version disclosure
          X-Powered-By: "" # prevent version disclosure
          X-Forwarded-Proto: "https"
          #Permissions-Policy: "accelerometer=(), autoplay=(), camera=(), display-capture=(), encrypted-media=(), fullscreen=(), gamepad=(), geolocation=(), gyroscope=(), hid=(), identity-credentials-get=(), idle-detection=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), storage-access=(), usb=(), web-share=(), window-management=(), xr-spatial-tracking=()"
          #Cross-Origin-Embedder-Policy: "unsafe-none"
          #Cross-Origin-Opener-Policy: "same-origin"
          #Cross-Origin-Resource-Policy: "same-site"
          #X-Permitted-Cross-Domain-Policies: "none"
          sslProxyHeaders:
            X-Forwarded-Proto: "https"
          hostsProxyHeaders:
            - "X-Forwarded-Host"
          #customRequestHeaders:
          #  X-Forwarded-Proto: "https"
          contentTypeNosniff: true # X-Content-Type-Options
          customFrameOptionsValue: "SAMEORIGIN" # X-Frame-Options
          browserXssFilter: false # X-XSS-Protection; deprecated
          referrerPolicy: "strict-origin-when-cross-origin" # Referrer-Policy
          forceSTSHeader: true # HTTP-Strict-Transport-Security (HSTS)
          stsIncludeSubdomains: true # HTTP-Strict-Transport-Security (HSTS)
          stsSeconds: 63072000 # HTTP-Strict-Transport-Security (HSTS)
          stsPreload: true # HTTP-Strict-Transport-Security (HSTS)
          #contentSecurityPolicy: "default-src 'self'; form-action 'self'; object-src 'none'; frame-ancestors 'none'; upgrade-insecure-requests; block-all-mixed-content" # Content-Security-Policy (CSP)

    # Authelia guard
    #authelia:
    #  forwardauth:
    #    address: http://authelia:9091/api/authz/forward-auth # replace example.com with your domain name
    #    trustForwardHeader: true
    #    authResponseHeaders:
    #      - Remote-User
    #      - Remote-Groups
    #      - Remote-Name
    #      - Remote-Email

    #crowdsec:
    #  plugin:
    #    bouncer:
    #      enabled: true
    #      defaultDecisionSeconds: 60
    #      crowdsecMode: live
    #      crowdsecAppsecEnabled: false
    #      crowdsecAppsecHost: crowdsec:7422
    #      crowdsecAppsecFailureBlock: true
    #      crowdsecAppsecUnreachableBlock: true
    #      crowdsecLapiKey: FIXME-LAPI-KEY # <--- replace this later
    #      crowdsecLapiHost: crowdsec:8080
    #      crowdsecLapiScheme: http
    #      crowdsecLapiTLSInsecureVerify: false
    #      forwardedHeadersTrustedIPs:
    #        # private class ranges
    #        - 10.0.0.0/8
    #        - 172.16.0.0/12
    #        - 192.168.0.0/16
    #        ## cloudflare ipv4
    #        #- 103.21.244.0/22
    #        #- 103.22.200.0/22
    #        #- 103.31.4.0/22
    #        #- 104.16.0.0/13
    #        #- 104.24.0.0/14
    #        #- 108.162.192.0/18
    #        #- 131.0.72.0/22
    #        #- 141.101.64.0/18
    #        #- 162.158.0.0/15
    #        #- 172.64.0.0/13
    #        #- 173.245.48.0/20
    #        #- 188.114.96.0/20
    #        #- 190.93.240.0/20
    #        #- 197.234.240.0/22
    #        #- 198.41.128.0/17
    #        ## cloudflare ipv6
    #        #- 2400:cb00::/32
    #        #- 2606:4700::/32
    #        #- 2803:f800::/32
    #        #- 2405:b500::/32
    #        #- 2405:8100::/32
    #        #- 2a06:98c0::/29
    #        #- 2c0f:f248::/32
    #      clientTrustedIPs:
    #        # private class ranges
    #        - 10.0.0.0/8
    #        - 172.16.0.0/12
    #        - 192.168.0.0/16

    # rate limiting
    rate-limit:
      rateLimit:
        average: 100
        period: 1
        burst: 100

# Only use secure ciphers - https://ssl-config.mozilla.org/#server=traefik&version=2.9&config=intermediate&guideline=5.6
tls:
  options:
    default:
      #sniStrict: true # prevents leaking default cert; see https://doc.traefik.io/traefik/v2.2/https/tls/#strict-sni-checking
      minVersion: VersionTLS12
      cipherSuites:
        - TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
        - TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
        - TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
        - TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
        - TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305
        - TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305

# Special TCP section from ChatGPT for TCP passthrough to allow MQTT & WSS operation

#tcp:
# routers:
#    mqtt_tls:
#      entryPoints:
#        - mqtts
#      rule: "HostSNI(`mqtt.dreamwoodestate.net`)"
#      service: mqtt_tls_service
#      tls:
#        passthrough: true

#    mqtt_ws:
#      entryPoints:
#        - mqtt-ws
#      rule: "HostSNI(`mqtt.dreamwoodestate.net`)"
#      service: mqtt_ws_service
#      tls:
#        passthrough: true

#  services:
#    mqtt_tls_service:
#      loadBalancer:
#        servers:
#          - address: "192.168.88.67:8883"

#   mqtt_ws_service:
#      loadBalancer:
#        servers:
#          - address: "192.168.88.67:9011"

