http:
  middlewares:
    crowdsec:
      plugin:
        crowdsec-bouncer:
          crowdsecMode: live
          crowdsecLapiKey: HeneLa2mazFVzl5+DQRKOdchBuJxKdjrHsHBE/03Acs
          crowdsecLapiHost: crowdsec:8080
          crowdsecLapiScheme: http

    secHeaders:
        headers:
            browserXssFilter: true
            contentTypeNosniff: true
            frameDeny: true
#            sslRedirect: true
       #HSTS Configuration
            stsIncludeSubdomains: true
            stsPreload: true
            stsSeconds: 15552000
            forceSTSHeader: true
            customFrameOptionsValue: "SAMEORIGIN"
#    tracing-middleware:
#      tracing:
#        serviceName: traefik
#        sampleRate: 1.0
    default-chain:
      chain:
        middlewares:
          - secHeaders@file
          - crowdsec@file
#          - tracing-middleware@file
          - error-pages-middleware@docker

  serversTransports:
    insecureTransport:
      insecureSkipVerify: true

  routers:
    pve:
      rule: "Host(`pve.lan.ddnsgeek.com`)"
      entryPoints:
        - websecure
      service: pve
      middlewares:
        - authelia@docker
      tls:
        certResolver: myresolver
        options: mtls-private-admin@file

    pbs:
      rule: "Host(`pbs.lan.ddnsgeek.com`)"
      entryPoints:
        - websecure
      service: pbs
      middlewares:
        - authelia@docker
      tls:
        certResolver: myresolver
        options: mtls-private-admin@file

    pdm:
      rule: "Host(`pdm.lan.ddnsgeek.com`)"
      entryPoints:
        - websecure
      service: pdm
      middlewares:
        - authelia@docker
      tls:
        certResolver: myresolver
        options: mtls-private-admin@file

  services:
    pve:
      loadBalancer:
        serversTransport: insecureTransport
        servers:
          - url: "https://pve.sweet.home:8006"

    pbs:
      loadBalancer:
        serversTransport: insecureTransport
        servers:
          - url: "https://pbs.sweet.home:8007"

    pdm:
      loadBalancer:
        serversTransport: insecureTransport
        servers:
          - url: "https://pdm.sweet.home:8443"

tls:
  options:
    mtls-private-admin:
      minVersion: VersionTLS12
      sniStrict: true
      clientAuth:
        caFiles:
          - /etc/traefik/certs/ca/clients-ca.crt
        clientAuthType: RequireAndVerifyClientCert