http:
  middlewares:
    # HTTPS Redirect
    redirect-https:
      redirectScheme:
        scheme: https
        permanent: true

    # Metube Basic Auth
    metube-auth:
      basicAuth:
        users:
          - "vv:$2y$05$JdT8AGUO9bd.E/PiCmKaoOJS1RFlXkrrmZ5mJ4f8/a1bEW39L3FbS"

        realm: "MeTube Access"

    # Basic Auth Traefik Dashboard
    auth:
      basicAuth:
        users:
          - "admin:$2y$05$.CKDD82sNUxcpaRrLbHuK.dopqt1fgurc2yfTKAT5OFzT7RvPrJHK"
        realm: "Traefik Dashboard"

    # Basic Auth Dockmon
    dockmon-auth:
      basicAuth:
        users:
          - "admin:$2y$05$.CKDD82sNUxcpaRrLbHuK.dopqt1fgurc2yfTKAT5OFzT7RvPrJHK"
        realm: "Dockmon Access"

    # Cloudflare IP Whitelist
    cloudflare-ipwhitelist:
      ipWhiteList:
        sourceRange:
          - "173.245.48.0/20"
          - "103.21.244.0/22"
          - "103.22.200.0/22"
          - "103.31.4.0/22"
          - "141.101.64.0/18"
          - "108.162.192.0/18"
          - "190.93.240.0/20"
          - "188.114.96.0/20"
          - "197.234.240.0/22"
          - "198.41.128.0/17"
          - "162.158.0.0/15"
          - "104.16.0.0/13"
          - "104.24.0.0/14"
          - "172.64.0.0/13"
          - "131.0.72.0/22"

    # Authentik + secure headers
    security-chain:
      chain:
        middlewares:
          - authentik@file
          - security-headers@file
    authentik:
      forwardAuth:
        address: "http://authentik-server:9000/outpost.goauthentik.io/auth/traefik"
        trustForwardHeader: true
        authResponseHeaders:
          - X-authentik-username
          - X-authentik-groups
          - X-authentik-email
          - X-authentik-name
          - X-authentik-uid
          - X-authentik-jwt
          - X-authentik-meta-jwks
          - X-authentik-meta-outpost
          - X-authentik-meta-provider
          - X-authentik-meta-app
          - X-authentik-meta-version

    # Security Headers
    security-headers:
      headers:
        browserXssFilter: true
        contentTypeNosniff: true
        forceSTSHeader: true
        stsIncludeSubdomains: true
        stsPreload: true
        stsSeconds: 31536000
        customFrameOptionsValue: "SAMEORIGIN"
        customResponseHeaders:
          X-Content-Type-Options: "nosniff"
          Referrer-Policy: "strict-origin-when-cross-origin"

    # Nextcloud specific headers
    nextcloud-secure-headers:
      headers:
        hostsProxyHeaders:
          - "X-Forwarded-Host"
          - "X-Forwarded-Proto"
        referrerPolicy: "same-origin"
        customFrameOptionsValue: "SAMEORIGIN"

    # Rate limiting
    rate-limit:
      rateLimit:
        average: 100
        burst: 50
        period: 1m

    # Nextcloud chain
    nextcloud-chain:
      chain:
        middlewares:
          - nextcloud-secure-headers@file
          - security-headers@file