http:
  routers:
    # Traefik Dashboard (local access, ADMIN, local only)
    traefik-dashboard-local:
      rule: "Host(`traefik.workstation`)"
      entryPoints:
        - websecure
      service: api@internal
      middlewares:
        # - auth
        - security-headers
      tls: {}

    # Nextcloud AIO Interface (local access. ADMIN, local only)
    nextcloud-aio-local:
      rule: "Host(`nextcloud-aio.workstation`)"
      entryPoints:
        - websecure
      service: nextcloud-aio
      middlewares:
        - security-headers
      tls: {}

    # Termix (local access, (account required))
    termix-local:
      rule: "Host(`termix.workstation`)"
      entryPoints:
        - websecure
      service: termix
      middlewares:
        - security-headers
      tls: {}

    # MeTube (local access, (auth required))
    metube-local:
      rule: "Host(`metube.workstation`)"
      entryPoints:
        - websecure
      service: metube
      middlewares:
        - metube-auth
        - security-headers
      tls: {}

    # Portainer (dev acess, (account required))
    portainer-local:
      rule: "Host(`portainer.workstation`)"
      entryPoints:
        - websecure
      service: portainer
      middlewares:
        - security-headers
      tls: {}

    # Uptime Kuma (local access, (account required))
    uptime-kuma-local:
      rule: "Host(`uptime.workstation`)"
      entryPoints:
        - websecure
      service: uptime-kuma
      tls: {}

    # AdGuard Home (local access, (account required))
    adguard-local:
      rule: "Host(`adguard.workstation`)"
      entryPoints:
        - websecure
      service: adguard
      middlewares:
        - security-headers
      tls: {}

    # Nextcloud Main (public (account required))
    nextcloud-local:
      rule: "Host(`nextcloud.workstation`)"
      entrypoints:
        - websecure
      service: nextcloud
      middlewares:
        - nextcloud-chain
      tls: {}

    # Nextcloud Main (public (account required))
    penpot-local:
      rule: "Host(`penpot.workstation`)"
      entrypoints:
        - websecure
      service: penpot
      middlewares:
        - security-headers
      tls: {}

    # Dockmon (local access (account required))
    dockmon-local:
      rule: "Host(`dockmon.workstation`)"
      entryPoints:
        - websecure
      service: dockmon
      middlewares:
        - security-headers
      tls: {}

    # Gitea (local access (account required))
    gitea-local:
      rule: "Host(`gitea.workstation`)"
      entryPoints:
        - websecure
        - ssh
      service: gitea
      middlewares:
        - security-headers
      tls: {}

    # Glance (local access)
    glance-local:
      rule: "Host(`glance.workstation`)"
      entryPoints:
        - websecure
      service: glance
      middlewares:
        - security-headers
      tls: {}

    # Watercrawl (local access)
    watercrawl-local:
      rule: "Host(`watercrawl.workstation`)"
      entryPoints:
        - websecure
      service: watercrawl
      middlewares:
        - security-headers
      tls: {}

    # N8N (local only)
    n8n-local:
      rule: "Host(`n8n.workstation`)"
      entryPoints:
        - websecure
      service: n8n
      middlewares:
        - security-headers
      tls: {}

    # Landing Page (local access)
    forust-homepage-local:
      rule: "Host(`landing.workstation`)"
      entryPoints:
        - websecure
      service: forust-homepage
      middlewares:
        - security-headers
      tls: {}