http:
  routers:
    # Traefik Dashboard (ADMIN, local only)
    traefik-dashboard:
      rule: "Host(`traefik.workstation`)"
      entryPoints:
        - websecure
      service: api@internal
      middlewares:
        # - auth
        - security-headers
      tls: {}

    # Nextcloud AIO Interface (ADMIN, local is better)
    nextcloud-aio:
      rule: "Host(`nextcloud-aio.workstation`)"
      entryPoints:
        - websecure
      service: nextcloud-aio
      middlewares:
        - security-headers
      tls: {}

    # Termix (public (account required))
    termix:
      rule: "Host(`termix.forust.xyz`)"
      entryPoints:
        - websecure
      service: termix
      middlewares:
        - security-headers
      tls: {}

    # MeTube
    metube:
      rule: "Host(`metube.forust.xyz`)"
      entryPoints:
        - websecure
      service: metube
      middlewares:
        - metube-auth
        - security-headers
      tls: {}
    
    # Portainer (public (account required))
    portainer:
      rule: "Host(`portainer.forust.xyz`)"
      entryPoints:
        - websecure
      service: portainer
      middlewares:
        - security-headers
      tls: {}

    # Uptime Kuma
    uptime-kuma:
      rule: "Host(`uptime.forust.xyz`)"
      entryPoints:
        - websecure
      service: uptime-kuma
      tls: {}

    # AdGuard Home (public (account required))
    adguard:
      rule: "Host(`adguard.forust.xyz`)"
      entryPoints:
        - websecure
      service: adguard
      middlewares:
        - security-headers
      tls: {}


    # Nextcloud Main (public (account required))
    nextcloud:
      rule: "Host(`nextcloud.forust.xyz`)"
      entrypoints:
        - websecure
      service: nextcloud
      middlewares:
        - nextcloud-chain
      tls: {}

    # Dockmon (public (account required))
    dockmon:
      rule: "Host(`dockmon.forust.xyz`)"
      entryPoints:
        - websecure
      service: dockmon
      middlewares:
        # - dockmon-auth
        - security-headers
      tls: {}

    # Gitea (public (account required))
    gitea:
      rule: "Host(`gitea.forust.xyz`)"
      entryPoints:
        - websecure
        - ssh
      service: gitea
      middlewares:
        - security-headers
      tls: {}

    # # Glance (local only)
    # glance:
    #   rule: "Host(`glance.workstation`)"
    #   entryPoints:
    #     - websecure
    #   service: glance
    #   middlewares:
    #     - security-headers
    #   tls: {}

    # Watercrawl (local only)
    watercrawl:
      rule: "Host(`watercrawl.workstation`)"
      entryPoints:
        - websecure
      service: watercrawl
      middlewares:
        - security-headers
      tls: {}

    # N8N (local only)
    n8n:
      rule: "Host(`n8n.workstation`)"
      entryPoints:
        - websecure
      service: n8n
      middlewares:
        - security-headers
      tls: {}


  serversTransports:
    insecureTransport:
      insecureSkipVerify: true